2FA and certificate

[chens]

Hello friends.

For my workers, I am using 2FA (AD+DUO) as the authentication process.

I would like to add additional to the 2FA authentication, by enforcing checking the existence of a client certificate.

My goal is to eliminate using GP from laptops that don't have my PFX installed. (i will install them manually).

I want the cert to be an additional phase.

I don't want to use HIP because i dont have GP license and using the default GP profiles.

Is it possible?

[TomYoung · Accepted solution]

Hi @chens ,

Yes, it is possible.  The only thing you need to do to configure GP client certificate authentication AND username/password/MFA is as follows:

1. Install the certificate on the client (step 4 in the link below).  It could be unique for each client or the same.
2. Create a certificate profile (step 5) and select it on the bottom of the Authentication tab of the portal and/or gateway.
3. Make sure the Client Authentication configuration has "No (User Credentials AND Client Certificate Required)" selected for "Allow Authentication with User Credentials OR Client Certificate."

https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/globalprotect-quick-configs/...

That's it!

Thanks,

Tom