End-of-Life (EoL)

Set Up External Authentication

The following workflow describes how to set up the GlobalProtect portal and gateways to use an external authentication service. The supported authentication services are LDAP, Kerberos, RADIUS, or TACACS+.
This workflow also describes how to create an optional
authentication profile
that a portal or gateway can use to identify the external authentication service. This step is optional for external authentication because the authentication profile also can specify the local authentication database or None.
GlobalProtect also supports local authentication. To use local authentication, create a local user database (
Device
Local User Database
) that contains the users and groups to which you want to allow VPN access and then refer to that database in the authentication profile.
  1. Create a server profile.
    The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.
    If you want to Enable Delivery of GlobalProtect Client VSAs to a RADIUS Server, you must create a RADIUS server profile.
    If you are using LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
    1. Select
      Device
      Server Profiles
      and select the type of profile (
      LDAP
      ,
      Kerberos
      ,
      RADIUS
      , or
      TACACS+
      ).
    2. Click
      Add
      and enter a
      Name
      for the profile, such as GP-User-Auth.
    3. (LDAP only) Select the
      Type
      of LDAP server.
    4. Click
      Add
      in the Servers section and then enter the necessary information for connecting to the authentication server, including the server
      Name
      , IP address or FQDN of the
      Server
      , and
      Port
      .
    5. (RADIUS, TACACS+, and LDAP only) Specify settings to enable the authentication service to authenticate the firewall, as follows:
      • RADIUS and TACACS+—Enter the shared
        Secret
        when adding the server entry.
      • LDAP—Enter the
        Bind DN
        and
        Password
        .
    6. (LDAP only) If you want the device to use SSL or TLS for a more secure connection with the directory server, select the
      Require SSL/TLS secured connection
      check box (selected by default). The protocol that the device uses depends on the server
      Port
      :
      • 389 (default)—TLS (Specifically, the device uses the StartTLS operation, which upgrades the initial plaintext connection to TLS.)
      • 636—SSL
      • Any other port—The device first attempts to use TLS. If the directory server doesn’t support TLS, the device falls back to SSL.
    7. (LDAP only) For additional security, select the
      Verify Server Certificate for SSL sessions
      check box so that the device verifies the certificate that the directory server presents for SSL/TLS connections. To enable verification, you also have to select the
      Require SSL/TLS secured connection
      check box. For verification to succeed, the certificate must meet one of the following conditions:
      • It is in the list of device certificates:
        Device
        Certificate Management
        Certificates
        Device Certificates
        . Import the certificate into the device, if necessary.
      • The certificate signer is in the list of trusted certificate authorities:
        Device
        Certificate Management
        Certificates
        Default Trusted Certificate Authorities
        .
    8. Click
      OK
      to save the server profile.
  2. (Optional) Create an authentication profile.
    The authentication profile specifies the server profile for the portal or gateways to use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more
    client authentication
    profiles
    .
    For descriptions of how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.
    To enable users to connect and change their own expired passwords without administrative intervention, consider using a pre-logon connect method. See Remote Access VPN with Pre-Logon for details.
    If users allow their passwords to expire, you may assign a temporary LDAP password to enable them to log in to the VPN. In this case, the temporary password may be used to authenticate to the portal, but the gateway login may fail because the same temporary password cannot be re-used. To prevent this, enable an authentication override in the portal configuration (
    Network
    GlobalProtect
    Portal
    ) to enable the agent to use a cookie to authenticate to the portal and use the temporary password to authenticate the gateway.
    1. Select
      Device
      Authentication Profile
      and
      Add
      a new profile.
    2. Enter a
      Name
      for the profile and then select the authentication
      Type
      :
      None
      ,
      Local Database
      (the authentication database on the firewall),
      RADIUS
      ,
      TACACS+
      ,
      LDAP
      , or
      Kerberos
      .
    3. If the authentication
      Type
      is RADIUS, TACACS+, LDAP, or Kerberos, select the authentication
      Server Profile
      that you created in 1 from the drop-down.
    4. Specify the domain name and username format. The device combines the
      User Domain
      and
      Username Modifier
      values to modify the domain/username string that a user enters during login. The device uses the modified string for authentication and uses the
      User Domain
      value for User-ID group mapping. Modifying user input is useful when the authentication service requires domain/username strings in a particular format and you don’t want to rely on users to correctly enter the domain. You can select from the following options:
      • To send only the unmodified user input, leave the
        User Domain
        blank (the default) and set the
        Username Modifier
        to the variable
        %USERINPUT%
        (the default).
      • To prepend a domain to the user input, enter a
        User Domain
        and set the
        Username Modifier
        to
        %USERDOMAIN%\%USERINPUT%
        .
      • To append a domain to the user input, enter a
        User Domain
        and set the
        Username Modifier
        to
        %USERINPUT%@%USERDOMAIN%
        .
        If the
        Username Modifier
        includes the
        %USERDOMAIN%
        variable, the
        User Domain
        value replaces any domain string that the user enters. If the
        User Domain
        is blank, that means the device removes any user-entered domain string.
    5. (Kerberos only) Configure Kerberos single sign-on (SSO) if your network supports it:
      • Enter the
        Kerberos Realm
        (up to 127 characters). This is the hostname portion of the user login name. For example, the user account name user@EXAMPLE.LOCAL has the realm EXAMPLE.LOCAL.
      • Specify a
        Kerberos Keytab
        file: click the
        Import
        link,
        Browse
        to the keytab file, and click
        OK
        . During authentication, the endpoint first tries to use the keytab to establish SSO. If it succeeds, and the user attempting access is in the
        Allow List
        , authentication succeeds immediately. Otherwise, the authentication process falls back to manual (username/password) authentication of the specified
        Type
        . The
        Type
        doesn’t have to be Kerberos. To change this behavior so that users can authenticate only using Kerberos, set
        Use Default Authentication on Kerberos Authentication Failure
        to
        No
        in a GlobalProtect portal agent configuration.
    6. (LDAP only) Enter
      sAMAccountName
      as the
      Login Attribute
      .
    7. (LDAP only) Set the
      Password Expiry Warning
      to specify the number of days before password expiration that users will be notified. By default, users will be notified seven days prior to password expiration (range is 1-255). Because users must change their passwords before the end of the expiration period, make sure you provide a notification period that is adequate for your user base to ensure continued access to the VPN. To use this feature, you must specify one of the following types of LDAP servers in your LDAP server profile:
      active-directory
      ,
      e-directory
      , or
      sun
      .
      Users cannot access the VPN if their passwords expire unless you enable pre-logon.
    8. (LDAP only) Configure an optional custom expiry message to include additional instructions, such as help desk contact information or a link to a password portal where users can change their passwords (see 5 in Customize the GlobalProtect Agent).
    9. Select the
      Advanced
      tab.
    10. In the Allow List,
      Add
      and then select the users and groups that are allowed to authenticate with this profile. Selecting the predefined
      all
      option allows every user to authenticate. By default, the list has no entries, which means no users can authenticate.
    11. Click
      OK
      .
  3. Commit the configuration.

Recommended For You