Global Protect Authentication Questions

[justinmoose]

Hi,

I'm going to setup Global Protect in our environment but have some questions before I configure it.  

1.  Can both a client certificate & SAML be used in conjunction for authentication?  If not, would an internal RADIUS server make the most sense for secondary authentication?  I want to use the client certificate to control device-based access so that the cert is only distributed by visiting the portal via the LAN.

2.  I noticed the GP Portal can be used for SCEP distribution.  I don't currently have an internal PKI setup.  Would it make the most sense to install the PKI/CA role on a Domain Controller (All Windows environment) and use the SCEP role from the GP portal for distribution or just issue it directly from the Domain Controller to authenticated users?  

3.  Should I use a dedicated public IP for external access to the GP portal or will the general outside interface IP suffice?  

Thank you in advance!!

[JayGolf]

Hi @justinmoose ,

1. Enforcing a client cert & using SAML together is nothing out of the ordinary. When a user connects to a portal/gw, the GP client presents the cert during TLS handshake, If the cert is valid, then GP redirects the user to your SAML IdP for auth. 

2. Since all of your GP endpoints are Windows and assuming domain-joined, using ADCS + GPO makes sense. This way certs are issued automatically as soon as a machine is joined to the domain and there is no user action/signing into the portal required.

If you later have a bunch of BYOD or non-domain devices, you could leverage GP's SCEP to authenticate those non-domain devices and then GP could broker a SCEP request to your internal CA to issue client certs. 

3. I recommend using a dedicated public IP for GP whenever possible to avoid port conflicts, simplify troubleshooting, and allow cleaner security policy separation. If your environment is small and doesn’t host other public services, using the existing untrust IP is fine. 

Hope this helps!