Enable Two-Factor Authentication Using Certificate and Authentication Profiles

1. Create an authentication server profile.

   The authentication server profile determines how the firewall connects to an external authentication service and retrieves the authentication credentials for your users. For information on creating an authentication server profile, refer to Set Up External Authentication.
2. Create an authentication profile that identifies the service for authenticating users. You later have the option of assigning the profile on the portal and gateways. For information on creating an authentication profile, refer to Set Up External Authentication.
3. Create a client certificate profile that the portal uses to authenticate the client certificates that come from user endpoints.

   When you configure two-factor authentication to use client certificates, the external authentication service uses the username value to authenticate the user, if specified, in the client certificate. This ensures that the user who is logging is in is actually the user to whom the certificate was issued.

   1. Do one of the following:

      • On Panorama, select DeviceCertificate ManagementCertificatesDevice Certificates, and then Generate a new certificate.
      • On Strata Cloud Manager, select ManageConfiguration NGFW and Prisma accessObjectsCertificate Management, and then Generate a new certificate.
   2. Enter a Name for the profile.
   3. Select one of the following Username Field values:

      • If you intend for the client certificate to authenticate individual users, select the certificate field that identifies the user.
      • If you are deploying the client certificate from the portal, select None.
      • If you are setting up a certificate profile for use with a pre-logon connect method, select None.
   4. Add the CA Certificates that you want to assign to the profile, and then configure the following settings:

      1. Select the CA certificate, either a trusted root CA certificate or the CA certificate from a SCEP server. If necessary, import the certificate.
      2. (Optional) Enter the Default OCSP URL.
      3. (Optional) Select a certificate for OCSP Verify Certificate.
      4. (Optional - Panorama only) Enter the Template Name for the template that was used to sign the certificate.
   5. (Optional) Select the following options to specify when to block the user’s requested session:

      1. Status of certificate is unknown.
      2. GlobalProtect component does not retrieve certificate status within the number of seconds in Certificate Status Timeout.
      3. Serial number attribute in the subject of a client certificate does not match the host ID that the GlobalProtect app reports for the endpoint.
      4. Certificates have expired.
   6. Click OK.
4. (Optional) Issue client certificates to GlobalProtect clients and endpoints.

   To deploy client certificates transparently, configure your portal to distribute a shared client certificate to your endpoints or configure the portal to use SCEP to request and deploy unique client certificates for each user.

   1. Use your enterprise PKI or a public CA to issue a client certificate to each GlobalProtect user.
   2. For the pre-logon connect methods, install certificates in the personal certificate store on the endpoint.
5. Save the GlobalProtect configuration.

   Click Commit.