- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
06-21-2016 11:28 PM - edited 06-21-2016 11:32 PM
Since we use our Palo Alto firewall, our users there Global Protect Client authenticate with the firewall through a certificate that is deployed thorugh Active Directory. Our Global Protect Client version is 3.0.2.
Since we updated our Pan-Os version to 7.0.6 this method of authentication does not work anymore.
THe client tries to authenticate and than there is a message: Enter username and password to login.
When to user fills in his credentials everything works, but this is not how we want it. The authentication need to go through the certificate.
I checked the Portal Gateway and it seems it has been modified with the update to 7.0.6. There is now a field SSL/TLS.
How can I fix this issue?
06-23-2016 12:59 AM
Yesterday we found the solution. Due the update the settings for cert authentication are a bit different.
In the certificate profile you need to choose on what detail in the cert it has to check: CN, Principel name, Email.
We check for the principel name, because the principel name has to be in a specific group before it can login through the certificate.
Now everything works.
06-21-2016 11:52 PM
But you have LDAP profile also chosen so it is expected that user/password is asked.
06-21-2016 11:59 PM - edited 06-22-2016 12:03 AM
Our vendor did this and said it was a bckup in case the certificate does not work.
So how I can make everything work again?
06-22-2016 12:01 AM
If both are chosen both are asked.
If cert fails then just login fails.
Maybe someone will correct me 🙂
06-22-2016 12:04 AM
Raido, you are correct.
His configuration is two-factor auth. (cert and ldap)
06-22-2016 12:06 AM
It is no problem that the LDAP is the backup solution but if the client has the certificate no ldap is required.
06-22-2016 12:46 AM
ZEBIT your current setup does not set LDAP as backup.
There is AND between those profiles.
You require certificate AND credentials.
06-22-2016 01:04 AM
Ok, than our vendor did a mis configuration. Strange that it worked before we updated to PAN OS 7.0.6.
How can I make it work when the client has the certificate it can authenticate?
06-22-2016 05:33 AM
Your internal users who have cert use one portal address with portal/gateway config that authenticates with certificate and third parties use different portal id that points to different gateway. Portal/gateway set up for third parties who don't have client cert authenticate only using LDAP.
06-23-2016 12:59 AM
Yesterday we found the solution. Due the update the settings for cert authentication are a bit different.
In the certificate profile you need to choose on what detail in the cert it has to check: CN, Principel name, Email.
We check for the principel name, because the principel name has to be in a specific group before it can login through the certificate.
Now everything works.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!