Is it possible to use HIPs to verify the presence of a Client Side Certificate such as GlobalProtect cert for a computer and also check for cert on a mobile device? If the device has the cert then we would allow it through a firewall policy.
Solved! Go to Solution.
Hello,
GP has a certificate it can use to verify the client. Check this article out and see if it meets your requirements.
Cheers!
Hello,
Would this device you are attempting to check behind the firewall or connecting via a client VPN connection?
Regards,
Thanks for replying and it would be connecting via a GlobalProtect VPN client.
Hello,
GP has a certificate it can use to verify the client. Check this article out and see if it meets your requirements.
Cheers!
Thanks for that info. The issue is that we would need to check for a specfic certificate: the machine certificate and I cannot seem to find a registry entry that allows me to do that. I believe I need to open a case with Palo Alto Support and I will report back with results if possible. Thank You
Well in the end we did not find a way to use HIPs custom checks in order to verify a machine certificate. The issue being that the certificate stuff is stored in the registry in blob format which doesnt allow parsing for specifics.
I have convinced the team to move forward by using GlobalProtect Certificate check against our PKI
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!