How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.

[Alpalo]

Hello team,

I need to know How to configure VPN and Certificates to cut VPN access when the Certificate is revoked.

I have revoked a certificate into the Firewall but I can connect anyway from VPN.... I am using on my GlobalProtect connection and the connections are working fine, I need to cut this connection when the certificate is revoked, can anyone help me?

Regards

[aleksandar.astardzhiev]

Hi @Alpalo ,

The certificate are form of authentication. Which means they are used when user is initiating a connection to the firewall.

Revoking certificate does not affect currently established connection, the  same way  as disabling user account would disconnect the user if he has connected with username and password.

You need to manually disconnect the GP client from the gateway - if there is currently established session.

To prevent the user from connecting again you need to enable CRL or OCSP check in Ceritificate Profile that you assign for your GP Portal/Gateway. Look  at section 8.Certificate Profile, step 7 on the following link - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFoCAK

7. (optional) Check CRL or OCSP if the portal/gateway needs to verify the client/machine cert's revocation status using CRL or OCSP. Please use this with caution as it can result in clients failing to connect if used in conjunction with 'Block session if certificate status is unknown'.

Note that above is assuming you are  using internal PKI, to which firewall has access from its dedicated mgmt interface.

If you are using self-signed  CA that is generated by the firewall you will need to enable OCSP reponder as described here - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIzCAK