Kerberos Authentication

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Kerberos Authentication

Not applicable

Hello all,

I'm trying to understand how Kerberos authentication works on the PAN. From what I understand is that Kerberos does not send any passwords over the network but generates tickets.

1) When a user logs on a SSL VPN portal which is configured for Kerberos authentication, the user types in the password. But how handle the PAN the password? The KDC (AD) does not have a plaintext version of the user his password. So how is the ticket generated ?

2) Is there a possibility to use Kerberos delegation? Since the KDC does not have an account of the PAN in directory, there is no mutual authentication.

Any suggestions?




L7 Applicator


We have an online document here:

It talks about how to configure and how Kerberos works.

Please review this information and let us know if this answers your question or not.

LIVEcommunity team member
Stay Secure,
Don't forget to Like items if a post is helpful to you!

This document describes how to implement Kerberos. I'm looking for more detailed explanation how it works.

When the end user connects to the SSL Portal, he is prompted to enter his credentials, username and password. Since the PA device plays the role of a Kerberos client, how can the PA 'protect' the password of the client. Does the PA have access to the shared secret key ? And if yes, how does the domain controller knows if the request comes from the PA device. There is no trust between the domain controller and the PA device.

On one of my previous implementations I've used MS ISA server. Kerberos authentication was only possible if the device is a member of the domain. But the PA is no member of the domain. Or more simple, a Windows client needs to be a member of the domain before he can use Kerberos. Then we have a 'trust'.

Secondly, if the ticket is about to expire, who renewes the TGT. The end user or the PA device?




The PAN firewall does not directly participate in Kerberos authentication of clients, it relays the requests from the client to the servers that are configured in your Kerberos authentication profile.  Consequently, no trust needs to be established with the firewall, as both members will have the keys necessary as they are both in the same domain.  Also, TGT renewal requests will be renewed by the end user's workstation.

If you would like more information on Kerberos, please follow this link to Microsoft's TechNet:

  • 3 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!