About Remo

I would recommend using different credentials for your admin login. In this case it would be easy to distinguish between a normal and an admin user.   The other possibility you have is using different authentication profiles with the same radius server profiles attached to it. Paloalto devices send the authentication profile name as an attribute in the radius request, which you could use in different radius authentication rules to itentify which login comes from GP and which one from an admin login. ... View more

I don't know 100% if this information is still valid but in the past I think only http url's were supported. I also searched in the documentation and so far I was not able to find something about an ldap url. If the url is included in your certificate then it will be enough if you simply click the checkboses for "Use OCSP" and "Use CRL". OCSP is always the preferred one. In the url's you only need the url for your intermediate CA, because this is the one which signs your client/user certificates. Ok, the inermediate can be revoked too but if you ever run into a problem with this one revoked then you need to manually change the cert on the firewall anyway. But if you simply import the root cert to your fw cert store, the fw will also get revocation information for that cert and likely mark your inermediate as invalid if it is revoked, but I did never test this. ... View more

Did you add your self signed root cert to the client configuration in global protect portal? https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-portals/define-the-globalprotect-agent-configurations#_43122 ... View more