Is there an idiots guide to deploying certificate-based pre-logon for Global protect?

[darren_g]

Folks.

As the subject requests, is there an "idiots guide" to deploying certificate-based pre-login for Global Protect?

My boss wants me to implement it so that pc's which are VPN-only connected can run domain scripts (machine policies) which only run on login - but you obviously don't connect to the domain until *after* you've logged in locally to the PC in the case of a VPN connected client - which means we need to have the PC connected to the VPN *before* login, so it can run scripts when the user actually logs in.

I've looked through the docs a bit, but can;t get my head around a few things - mainly, how you create and deploy the certificates which the PC's use to verify/connect to the firewall before the user logs in and supplies actual credentials to Global Protect.

Any pointers appreciated.

Thanks.

[gswcowboy · Accepted solution]

this didn't help? if not, create a case after you're initial config and we can assist further

How To Configure GlobalProtect SSO With Pre-Logon Access Using Self-Signed Certificates

[pulukas]

darren.g wrote:

mainly, how you create and deploy the certificates which the PC's use to verify/connect to the firewall before the user logs in and supplies actual credentials to Global Protect.

For certificate authentication on a windows domain you can use group policy to automatically create the certificates and auto enroll the domain computers. 

Configure Group Policy to Autoenroll and Deploy Certificates

With windows GINA pre login you essentially connect the login process on the computer to the creation of the vpn connection at login time.  This way you do get the benefits of on network login from the vpn connected computers.

[darren_g]

nato wrote:

this didn't help? if not, create a case after you're initial config and we can assist further

How To Configure GlobalProtect SSO With Pre-Logon Access Using Self-Signed Certificates

That wasn't the doc I found and was referring to - but it looks like the doc I need!

Thanks!

[gswcowboy]

No prob. If you get stuck, please open a case so we can rectify issue.