CRL for Globalprotect

[g-crisostomo]

Hi, greetings.

Is there a way to use the CLR to verify the machine/user certificate through globalprotect, to drop connections if the certificate is revoked?

[TomYoung]

Hi @g-crisostomo ,

GP uses a Certificate Profile to authenticate certificates, and it has a check box to use CRL.  Theoretically, the authentication should fail if the certificate is revoked.  Please let us know the results if you configure it!

Thanks,

Tom

[g-crisostomo]

I have marked this option, but how can I assure the CRL is being used?

I added the URL from the certificate to the Default OCSP URL but still I can't see how I can refer to the list.

[TomYoung · Accepted solution]

Hi @g-crisostomo ,

OCSP is a different protocol.  If you check the URL box, for every certificate authentication request the NGFW should check the CRL listed in the CA certificate in the same certificate profile.  The best way to check is to revoke a certificate and see if the authentication fails.  If traffic from the management interface to the CRL URL goes through the NGFW, you should also see the session in the logs.

Thanks,

Tom

[g-crisostomo]

Thank you for your help, I guess I found out whats going on; The CRL listed on certificate in the firewall, is different from the user's certificate CRL, because they have 2 servers issuing certificates and they didn't point me this until now.

Thanks once again.