GlobalProtect Certificate Profile Issue

cancel
Showing results for 
Search instead for 
Did you mean: 

GlobalProtect Certificate Profile Issue

L1 Bithead

Hello,

 

I have a situation where I am looking for advice and help. 

 

An existing PA5050 is a portal/gateway and we have several global PAs as gateways also

The gateway authentication on the Portal/Gateway uses external authentication and NO certificate profile

The subordinate gateways globally use external authentication and certificate profiles.  The certificate used is an intermediate certificate

The client endpoints have a client certificate installed as machine certificates

 

The above all works as expected

 

I have installed a new test portal on the exiting portal PA5050 using the same configuration and certificates as the production above

I have installed a new PA5050 gateway that will act as only a gateway and is configured with a new GP gateway setup, using the same root, intermediate and server certificate as the portal

When clients authenticate with the portal (test profile) they receive the new gateway and during connection with the gateway fail the certificate authentication.  

The new test gateway certificate profile calls for the intermediate certificate, the same used in the production setup, to avoid having to install new machine certs on the endpoints.

So essentially a new test portal on a legacy GP device using existing certificates and a new gateway on a new appliance using the legacy certificates

 

When authentication we receive the "GlobalProtect gateway user authentication failed. Login from: xx.xx.xx.xx, Source region: MY, User name: , Client OS version: Microsoft Windows 10 Enterprise , 64-bit, Reason: client cert invalid, Auth type: profile

Looking for advice on where to check and what.  Could it be an issue with how internal CA certs have been imported into the new gateway appliance?  Could it be something I have missed in the authentication setup?  

I have gone through the config comparison between this test environment and the prod environment and can find no config discrepancy so looking for deep dive on perhaps it being an issue with the certs.

 

The version is PANOS 8.1.4

 

Thanks in advance.

1 ACCEPTED SOLUTION

Accepted Solutions

L1 Bithead

Hello All,

 

Firstly thanks to Mick for his previous suggestion.  I did test the gateway as a portal and the certificate chain is working fine.

 

We finally managed to get a PA engineer onto the box and they have just advised there is a known bug (PAN-160744) in the 8.1.18 code that prevents successful certificate checking where the mp clock and dp clock have a -1ms diff.  

 

This is fixed in 8.1.20 and we now have to wait until 5 Aug 2021 to get a hold of that release.

 

Regards

View solution in original post

2 REPLIES 2

L7 Applicator

not sure of the exact reason here but to go back a step...   on your new gateway try adding a new portal using the same cert profile as the gateway and just https browse to it...   see if same error... 

L1 Bithead

Hello All,

 

Firstly thanks to Mick for his previous suggestion.  I did test the gateway as a portal and the certificate chain is working fine.

 

We finally managed to get a PA engineer onto the box and they have just advised there is a known bug (PAN-160744) in the 8.1.18 code that prevents successful certificate checking where the mp clock and dp clock have a -1ms diff.  

 

This is fixed in 8.1.20 and we now have to wait until 5 Aug 2021 to get a hold of that release.

 

Regards

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!