Trying to configure GlobalProtect VPN with user certificates on 4.1.x

[NinthShot]

Hello-

I currently have a PA-500 running 4.1.2 and am trying to configure a client certificate-based VPN as outlined in this document:

However, that document is for the old NetConnect (pre-4.1.x) VPNs so I've been trying to merge the instructions contained therein with the the 4.1.x GlobalProtect instructions:

I have been able to get the appropriate certificates installed on user machines and uploaded to the firewall.  At this point, however, I'm unsure on how to proceed--when configuring the portal where do I use the firewall-supplied CA/certificates and where do I use the server-supplied CA/certificates?

Furthermore, I'm pretty green on the whole certificates and VPN thing.  I've used both and have some understanding of them, but this is my first time implementing a VPN (on a Palo Alto device or otherwise).  Does anybody know of some sort of "VPN basics" guide here on the Palo Alto site that will assist someone with his first PA VPN setup?  I've found plenty of technical guides but most of these assume some familiarity with the subject that I apparently lack.

Thanks for any help you can provide.

[jdelio]

I would suggest starting with this document:

Configuring Global Protect

And then as far as Certificates, you should be able to create a local CA, and then create User Certs from there.

Please let us know if you require more information.

Kind Regards,

[NinthShot]

Hello-

Thank you for your reply. 

I've gotten as far as establishing the local CA and creating user certificates; where I'm getting hung up is where I apply those certificates vs. the certificates self-issued by the firewall (the ones that, to my understanding, are used to establish the link between the firewall and the VPN client).

Thanks again.

[david3]

It sounds like you are past where that quick start document would be anyway as it describes setting up Global Protect and doesn't describe what to do with the client cert for authentication.

I haven't been able to try yet as I have to go build a CA (and it would appear an external CA is required for client cert auth), but perhaps if you already have one you can give what is described at the bottom of thread 7126 (https://live.paloaltonetworks.com/message/7126) a shot?