Remote Access VPN with Two-Factor Authentication

If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can provide two-factor authentication), the end user must succeed at authentication through both profiles before gaining access. For portal authentication, this means that certificates must be pre-deployed to the end clients before their initial portal connection. Additionally, the client certificate presented by a client must match what is defined in the certificate profile.

If the certificate profile does not specify a username field (that is, the
Username Field
it is set to
None
), the client certificate does not need to have a username. In this case, the client must provide the username when authenticating against the authentication profile.
If the certificate profile specifies a username field, the certificate that the client presents must contain a username in the corresponding field. For example, if the certificate profile specifies that the username field is Subject, the certificate presented by the client must contain a value in the common-name field, or else the authentication fails. In addition, when the username field is required, the value from the username field of the certificate is automatically populated as the username when the user attempts to enter credentials for authenticating to the authentication profile. If you do not want force users to authenticate with a username from the certificate, do not specify a username field in the certificate profile.

This quick configuration uses the same topology as Figure: GlobalProtect VPN for Remote Access. However, in this configuration the clients must authenticate against a certificate profile and an authentication profile. For more details on a specific type of two-factor authentication, see the following topics:

Enable Two-Factor Authentication Using Certificate and Authentication Profiles
Enable Two-Factor Authentication Using One-Time Passwords (OTPs)
Enable Two-Factor Authentication Using Smart Cards

Use the following procedure to configure VPN Remote Access with Two-Factor Authentication.

Create Interfaces and Zones for GlobalProtect.
Use the
default
virtual router for all interface configurations to avoid having to create inter-zone routing.
Select
Network
Interfaces
Ethernet
and configure ethernet1/2 as a Layer 3 Ethernet interface with IP address
203.0.113.1
and assign it to the l3-untrust security zone and the default virtual router.
Create a DNS “A” record that maps IP address
203.0.113.1
to
gp.acme.com
.
Select
Network
Interfaces
Tunnel
and add the
tunnel.2
interface and add it to a new zone called
corp-vpn
. Assign it to the default virtual router.
Enable User Identification on the corp-vpn zone.
Create security policy to enable traffic flow between the corp-vpn zone and the l3-trust zone to enable access to your internal resources.
Select

Policies

Security

and then click

Add

to add a new rule.

For this example, you would define the rule with the following settings:

Name—
VPN Access
Source Zone—
corp-vpn
Destination Zone—
l3-trust


Obtain a server certificate for the interface hosting the GlobalProtect portal and gateway using one of the following methods:
(Recommended) Import a server certificate from a well-known, third-party CA.
Use the root CA on the portal to generate a self-signed server certificate.
Select
Device
Certificate Management
Certificates
to manage certificates as follows:
Obtain a server certificate. Because the portal and gateway are on the same interface, the same server certificate can be used for both components.
The CN of the certificate must match the FQDN,
gp.acme.com
.
To enable clients to connect to the portal without receiving certificate errors, use a server certificate from a public CA.
Issue client certificates to GlobalProtect clients and endpoints. This enables the GlobalProtect portal and gateways to validate that the device belongs to your organization.
Use your enterprise PKI or a public CA to issue a unique client certificate to each GlobalProtect user.
Install certificates in the personal certificate store on the endpoints.
Create a client certificate profile.
Select
Device
Certificate Management
Certificate Profile
,
Add
and enter a profile
Name
such as
GP-client-cert
.
Specify where to get the username that will be used to authenticate the end user:
From user
—If you want the end user to supply a username when authenticating to the service specified in the authentication profile, select
None
as the
Username Field
.
From certificate
—If you want to extract the username from the certificate, select
Subject
as the
Username Field
. If you use this option, the CN contained in the certificate will automatically populated the username field when the user is prompted to login to the portal/gateway and the user will be required to log in using that username.
In the CA Certificates section,
Add
and then select the
CA Certificate
that issued the client certificates, and click
OK
twice.
Create a server profile.
The server profile instructs the firewall how to connect to the authentication service. Local, RADIUS, Kerberos, and LDAP authentication methods are supported. This example shows an LDAP authentication profile for authenticating users against the Active Directory.
Create the server profile for connecting to the LDAP server (
Device
Server Profiles
LDAP
).

(Optional) Create an authentication profile.
Attach the server profile to an authentication profile (
Device
Authentication Profile
).

Configure a GlobalProtect Gateway.
See the topology diagram shown in Figure: GlobalProtect VPN for Remote Access.
Select
Network
GlobalProtect
Gateways
and add the following configuration:
Interface
—
ethernet1/2
IP Address
—
203.0.113.1
Server Certificate
—
GP-server-cert.pem issued by GoDaddy
Certificate Profile
—
GP-client-cert
Authentication Profile
—
Corp-LDAP
Tunnel Interface
—
tunnel.2
IP Pool
—
10.31.32.3 - 10.31.32.118
Configure the GlobalProtect Portal.
Select
Network
GlobalProtect
Portals
and add the following configuration:
Set Up Access to the GlobalProtect Portal:
Interface
—
ethernet1/2
IP Address
—
203.0.113.1
Server Certificate
—
GP-server-cert.pem issued by GoDaddy
Certificate Profile
—
GP-client-cert
Authentication Profile
—
Corp-LDAP
Define the GlobalProtect Agent Configurations:
Connect Method
—
On-demand
(Manual user initiated connection)
External Gateway Address
—
gp.acme.com
Deploy the GlobalProtect Agent Software.
Select
Device
GlobalProtect Client
.
In this example, use the procedure to Host Agent Updates on the Portal.
(Optional) Deploy Agent Settings Transparently.
As an alternative to deploying agent settings from the portal configuration, you can define settings directly from the Windows registry or global MAC plist. Examples of settings that you can deploy include specifying the portal IP address or enabling GlobalProtect to initiate a VPN tunnel before a user logs in to the device and connects to the GlobalProtect portal. On Windows clients only, you can also configure settings using the MSIEXEC installer. For additional information, see Customizable Agent Settings.
(Optional) Enable use of the GlobalProtect mobile app.
Purchase and install a GlobalProtect Gateway subscription (
Device
Licenses
) to enable use of the app.
Save the GlobalProtect configuration.
Click
Commit
.