Globalprotect client authenticate with a certificate not working anymore

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Globalprotect client authenticate with a certificate not working anymore

L3 Networker

Since we use our Palo Alto firewall, our users there Global Protect Client authenticate with the firewall through a certificate that is deployed thorugh Active Directory. Our Global Protect Client version is 3.0.2.

Since we updated our Pan-Os version to 7.0.6 this method of authentication does not work anymore.

THe client tries to authenticate and than there is a message: Enter username and password to login.

When to user fills in his credentials everything works, but this is not how we want it. The authentication need to go through the certificate.

I checked the Portal Gateway and it seems it has been modified with the update to 7.0.6. There is now a field SSL/TLS.

How can I fix this issue?

PA.JPGPA_Portal.JPG

1 accepted solution

Accepted Solutions

Yesterday we found the solution. Due the update the settings for cert authentication are a bit different.

In the certificate profile you need to choose on what detail in the cert it has to check: CN, Principel name, Email.

We check for the principel name, because the principel name has to be in a specific group before it can login through the certificate.

Now everything works.

View solution in original post

9 REPLIES 9

Cyber Elite
Cyber Elite

But you have LDAP profile also chosen so it is expected that user/password is asked.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Our vendor did this and said it was a bckup in case the certificate does not work.

So how I can make everything work again?

If both are chosen both are asked.

If cert fails then just login fails.

Maybe someone will correct me 🙂

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Raido, you are correct.

His configuration is two-factor auth. (cert and ldap)

It is no problem that the LDAP is the backup solution but if the client has the certificate no ldap is required.

ZEBIT your current setup does not set LDAP as backup.

There is AND between those profiles.

You require certificate AND credentials.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Ok, than our vendor did a mis configuration. Strange that it worked before we updated to PAN OS 7.0.6.

How can I make it work when the client has the certificate it can authenticate?

Your internal users who have cert use one portal address with portal/gateway config that authenticates with certificate and third parties use different portal id that points to different gateway. Portal/gateway set up for third parties who don't have client cert authenticate only using LDAP.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Yesterday we found the solution. Due the update the settings for cert authentication are a bit different.

In the certificate profile you need to choose on what detail in the cert it has to check: CN, Principel name, Email.

We check for the principel name, because the principel name has to be in a specific group before it can login through the certificate.

Now everything works.

  • 1 accepted solution
  • 3811 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!