Configure a Certificate to Decrypt the Authentication Override Cookie (Panorama Managed NGFW)

Table of Contents

Set Up Pre-Logon for Prisma Access Agent

Export the Authentication Override Cookie for Connecting to an On-Premises NGFW Gateway (Coexistence Tenant)

Configure a Certificate to Decrypt the Authentication Override Cookie (Panorama Managed NGFW)

Learn how to configure the certificate to decrypt the authentication override cookie.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Panorama)	Minimum required PAN-OS version: 11.2 Prisma Access Agent version: 25.1.0.14

For a user to connect to the gateway successfully, the same authentication override cookie certificate that you configured for gateway authentication in the Infrastructure settings page needs to be decrypted on the NGFW gateway. To do this, you will need to configure the gateway that you want the Prisma Access Agent to access with the authentication override certificate.

Complete the following steps to configure the gateway:

From the Cloud Services plugin in the Panorama that’s managing your NGFW deployment, select NetworkGlobalProtectGateways.
Select the gateway for which you want to configure the authentication override.
Select AgentClient Settings<gateway configuration>.
Select Authentication Override, and Accept cookie for authentication override.
Select the Certificate to Encrypt/Decrypt Cookie. This should be the same certificate as the one you imported in the Infrastructure tab.
Click OK to save the configuration and then click OK to save the GlobalProtect gateway configuration settings.
Commit and push your configuration by selecting CommitCommit and Push.
Click Commit and Push.