User-id with GP client certificate authentication

[ahwang2929]

Hi,

I have questions regarding user-id operation with GP client certificate authentication only for iOS/Android devices.

Current state:

• We have GlobalProtect portal and external gateway on the same firewall with SAML authentication for mobile devices - iOS (on-demand, but enforcement to use VPN is achieved with proxy file) and Chrombook (always-on)
• IHD (Internal Host Detection) is not used hence mobile devices are always tunnelled to the external gateway even they are on the internal network.

Target state:

• Reconfigure GlobalProtect with a unique client certificate profile for authentication without other authentication methods. (Remove SAML authentication)
• Configure Certificate profile with username field of Subject (common-name)
• Change App connection method to always-on for iOS devices.
• Enable IHD(Internal Host Detection) to make clients on internal network won’t be tunnelled.
• Create new GP internal gateway without establishing a VPN tunnel to the firewall  to collect user-id information

Questions:

1) For devices on the internal network, is an internal GlobalProtect gateway required to report User-ID information to the firewall?

2) If we switch to client certificate-only authentication (no user credentials), will the GlobalProtect gateways still report User-ID mappings?
I assume the gateways extract the username from the certificate’s Subject (e.g., CN), so this should still work — can you confirm?

3) For accurate User-ID mapping, should we use user certificates rather than machine certificates?

Machine certificates contain the device name or host FQDN in the subject. So I assume firewall may end up mapping the IP to a device name, not the user which is not expected.

Thanks

[sk_display · Accepted solution]

1) Yes

2) You'll need an internal gateway

3) You're correct that the certificate will need a unique user attribute on it. We used the email field in the certificate SAN to populate the email address and extract the userid from there. On the internal gateway, you can select configure the certificate profile to pull that info from the certificate.