Enable Two-Factor Authentication Using Certificate and Authentication Profiles

Create an authentication server profile.
The authentication server profile determines how the firewall connects to an external authentication service and retrieves the authentication credentials for your users.
If you are using LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
Select
Device
Server Profiles
and a profile type (
LDAP
,
Kerberos
,
RADIUS
, or
TACACS+
).
Add
a new server profile.
Enter a
Profile
Name
for the profile, such as GP-User-Auth.
(LDAP only) Select the
Type
of LDAP server (
active-directory
,
e-directory
,
sun
, or
other
).
Click
Add
in the Servers list section and then enter the required information for connections to the authentication service, including the server
Name
, IP address or FQDN of the
Server
, and
Port
.
(RADIUS, TACACS+, and LDAP only) Specify settings to enable the firewall to authenticate to the authentication service as follows:
RADIUS and TACACS+—Enter the shared
Secret
when adding the server entry.
LDAP—Enter the
Bind DN
and
Password
.
(LDAP only) If you want the endpoint to use SSL or TLS for a more secure connection with the directory server, select the
Require SSL/TLS secured connection
check box (selected by default). The protocol that the device uses depends on the server
Port
in the
Server list
:
389 (default)—TLS (specifically, the device uses the StartTLS operation to upgrade the initial plaintext connection to TLS).
636—SSL.
Any other port—The device first attempts to use TLS. If the directory server does not support TLS, the device uses SSL.
(LDAP only) For additional security, select the
Verify Server Certificate for SSL sessions
check box so that the endpoint verifies the certificate that the directory server presents for SSL/TLS connections. To enable verification, you also must select the
Require SSL/TLS secured connection
check box. For verification to succeed, one of the following conditions must be true:
The certificate is in the list of device certificates:
Device
Certificate Management
Certificates
Device Certificates
. Import the certificate into the endpoint if necessary.
The certificate signer is in the list of trusted certificate authorities:
Device
Certificate Management
Certificates
Default Trusted Certificate Authorities
.
Click
OK
to save the server profile.
Create an authentication profile that identifies the service for authenticating users. (You later have the option of assigning the profile on the portal and on gateways.)
Select
Device
Authentication Profile
and
Add
a new profile.
Enter a
Name
for the profile.
Select the
Location
.
Select the
Type
of
Authentication
(
LDAP
,
Kerberos
,
RADIUS
, or
TACACS+
).
Select the
Server Profile
you created in 1.
(LDAP only) Enter
sAMAccountName
as the
Login Attribute
.
Click
OK
to save the authentication profile.
Create a client certificate profile that the portal uses to authenticate the client certificates that come from user devices.
When you configure two-factor authentication to use client certificates, the external authentication service uses the username value to authenticate the user, if specified, in the client certificate. This ensures that the user who is logging is in is actually the user to whom the certificate was issued.
Select
Device
Certificates
Certificate Management
Certificate Profile
and click
Add
and enter a profile
Name
.
Select a value for the
Username Field
:
If you intend for the client certificate to authenticate individual users, select the certificate field that identifies the user.
If you are deploying the client certificate from the portal, leave this field set to
None
.
If you are setting up a certificate profile for use with a pre-logon connect method, leave the field set to
None
.
In the
CA Certificates
area, click
Add
and then:
Select the
CA certificate
, either a trusted root CA certificate or the CA certificate from a SCEP server. (If necessary, import the certificate).
(Optional) Enter the
Default OCSP URL
.
(Optional) Select a certificate for
OCSP Verify CA
.
(Optional) Select options that specify when to block the user’s requested session:
Status of certificate is unknown.
GlobalProtect component does not retrieve certificate status within the number of seconds in
Certificate Status Timeout
.
Serial number attribute in the subject of a client certificate does not match the host ID that the GlobalProtect agent reports for the client endpoint.
Click
OK
.
(Optional) Issue client certificates to GlobalProtect users/machines (see Set Up Client Certificate Authentication).
To transparently deploy client certificates, configure your portal to distribute a shared client certificate to your endpoints or configure the portal to use SCEP to request and deploy unique client certificates for each user.
Use your enterprise PKI or a public CA to issue a client certificate to each GlobalProtect user.
For the pre-logon connect methods, install certificates in the personal certificate store on the client systems.
Save the GlobalProtect configuration.
Click
Commit
.