Global Protect pre-logon then on-demand configuration

[qdimclark]

We're using these versions (Yes, we need to upgrade, but other priorities at the moment)

PANos 8.1.14
Global Protect client 5.2.1

We're currently usingOn-Demand, which is working. We used this page with the only difference is we're using AD Authentication.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH2CAK

Now we want to use pre-logon then on-demand.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oM4ACAU

We used our internal PKI to create machine certs and those have been deployed using Group Policy.

What I'm not getting is how to configure GlobalProtect to use the machine cert for pre-logon.

Do I create a new SSL/TLS profile or certificate profile?

Can I use the PANos self-signed in conjunction with the PKI machine cert? Would the self-signed be for the portal and the machine cert be for the gateway?

I've gone through all the documents, as well as, the GP Admin guide.

Any advice or guidance is much appreciated!

[MickBall]

Portal Auth

Portal configs

Gateway Auth

Gateway conf

[qdimclark]

And your SSL/TLS profile points to your CA?

[MickBall]

Yes but not the same CA used for authentication.

[qdimclark]

Just a followup. I switched to using a wilcard cert for the portal and internal PKI with machine certs for pre-logon. I've passed this hurdle and now just need to resolve the cookie issue I'm having with pre-login.

Thanks for your help!

[qdimclark]

Hope y'all are well.

@CobaltixIT 

@MickBall 

Thank you both for your help. In the end we stood up an MS NPS server for RADIUS.

Now the portal has the wildcard.domain.com cert and the gateway has an internal PKI certificate. When a computer is joined to the domain they are issued a cert from our PKI. Then using RADIUS to authenticate Pre-Logon then Demand is working and users can change their password before logging in.

Since the company is allowing BYOD for remote users I have to configure GP to allow a non-domain computer to authenticate. (BYOD may change soon, but in the meantime...)