Trying to configure GlobalProtect VPN with user certificates on 4.1.x

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Trying to configure GlobalProtect VPN with user certificates on 4.1.x

L1 Bithead


I currently have a PA-500 running 4.1.2 and am trying to configure a client certificate-based VPN as outlined in this document:

However, that document is for the old NetConnect (pre-4.1.x) VPNs so I've been trying to merge the instructions contained therein with the the 4.1.x GlobalProtect instructions:

I have been able to get the appropriate certificates installed on user machines and uploaded to the firewall.  At this point, however, I'm unsure on how to proceed--when configuring the portal where do I use the firewall-supplied CA/certificates and where do I use the server-supplied CA/certificates?

Furthermore, I'm pretty green on the whole certificates and VPN thing.  I've used both and have some understanding of them, but this is my first time implementing a VPN (on a Palo Alto device or otherwise).  Does anybody know of some sort of "VPN basics" guide here on the Palo Alto site that will assist someone with his first PA VPN setup?  I've found plenty of technical guides but most of these assume some familiarity with the subject that I apparently lack.

Thanks for any help you can provide.


L7 Applicator

I would suggest starting with this document:

Configuring Global Protect

And then as far as Certificates, you should be able to create a local CA, and then create User Certs from there.

Please let us know if you require more information.

Kind Regards,

LIVEcommunity team member
Stay Secure,
Don't forget to Like items if a post is helpful to you!


Thank you for your reply. 

I've gotten as far as establishing the local CA and creating user certificates; where I'm getting hung up is where I apply those certificates vs. the certificates self-issued by the firewall (the ones that, to my understanding, are used to establish the link between the firewall and the VPN client).

Thanks again.

It sounds like you are past where that quick start document would be anyway as it describes setting up Global Protect and doesn't describe what to do with the client cert for authentication.

I haven't been able to try yet as I have to go build a CA (and it would appear an external CA is required for client cert auth), but perhaps if you already have one you can give what is described at the bottom of thread 7126 ( a shot?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!