Global Protect with Client Certificate Authentication

Reply
Highlighted
L2 Linker

Global Protect with Client Certificate Authentication

Hi all,

can somebody tell me if there is a manual or howto,
which describes in detail how to confígure this.

I read the "Quick Start Guide GP" and this thread
https://live.paloaltonetworks.com/message/7126

But I'm not getting it t work. When I connect to the portal site
with a browser I'm getting the message "Valid Client Certificate Required".

But I imported the cert.

I want to use a GP CA created on the PA itself,
and then create client certs which are signed with it.

In the new features for 4.1 I read that there is a limited GP for SSL
purposes only, so that you need no licenses. Does this mean I wouldn't
configure a portal and only a gateway and connect directly to the gateway?

If yes, can somebody explain how to do this. The GP agent give me a message "Wrong Portal"
when I try to connect directly to the gateway.

Regards
Christian

Highlighted
L3 Networker

Re: Global Protect with Client Certificate Authentication

The PAN can not take the role of an issuing CA for client certs.

You need to use an external CA.

Even in 4.1 you would still need a portal and a gateway. Both can be on the same box.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!