Enable Two-Factor Authentication Using Certificate and Authentication Profiles
The following workflow describes how to configure GlobalProtect client authentication requiring the user to authenticate both to a certificate profile and an authentication profile. The user must successfully authenticate using both methods in order to connect to the portal/gateway. For more details on this configuration, see Remote Access VPN with Two-Factor Authentication.
an authentication server profile.The authentication server profile determines how the firewall connects to an external authentication service and retrieves the authentication credentials for your users.If you are using LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
- Select DeviceServer Profiles and a profile type (LDAP, Kerberos, RADIUS, or TACACS+).
- Add a new server profile.
- Enter a ProfileName for the profile, such as GP-User-Auth.
- (LDAP only) Select the Type of LDAP server (active-directory, e-directory, sun, or other).
- Click Add in the Servers list section and then enter the required information for connections to the authentication service, including the server Name, IP address or FQDN of the Server, and Port.
- (RADIUS, TACACS+, and LDAP only) Specify settings
to enable the firewall to authenticate to the authentication service
- RADIUS and TACACS+—Enter the shared Secret when adding the server entry.
- LDAP—Enter the Bind DN and Password.
- (LDAP only) If you want the endpoint to use
SSL or TLS for a more secure connection with the directory server,
select the Require SSL/TLS secured connection check
box (selected by default). The protocol that the device uses depends
on the server Port in the Server
- 389 (default)—TLS (specifically, the device uses the StartTLS operation to upgrade the initial plaintext connection to TLS).
- Any other port—The device first attempts to use TLS. If the directory server does not support TLS, the device uses SSL.
- (LDAP only) For additional security, select
the Verify Server Certificate for SSL sessions check
box so that the endpoint verifies the certificate that the directory
server presents for SSL/TLS connections. To enable verification,
you also must select the Require SSL/TLS secured connection check
box. For verification to succeed, one of the following conditions
must be true:
- The certificate is in the list of device certificates: DeviceCertificate ManagementCertificatesDevice Certificates. Import the certificate into the endpoint if necessary.
- The certificate signer is in the list of trusted certificate authorities: DeviceCertificate ManagementCertificatesDefault Trusted Certificate Authorities.
- Click OK to save the server profile.
- Create an authentication profile that identifies the
service for authenticating users. (You later have the option of
assigning the profile on the portal and on gateways.)
- Select DeviceAuthentication Profile and Add a new profile.
- Enter a Name for the profile.
- Select the Location.
- Select the Type of Authentication (LDAP, Kerberos, RADIUS, or TACACS+).
- Select the Server Profile you created in 1.
- (LDAP only) Enter sAMAccountName as the Login Attribute.
- Click OK to save the authentication profile.
- Create a client certificate profile that the portal uses
to authenticate the client certificates that come from user devices.When you configure two-factor authentication to use client certificates, the external authentication service uses the username value to authenticate the user, if specified, in the client certificate. This ensures that the user who is logging is in is actually the user to whom the certificate was issued.
- Select DeviceCertificatesCertificate ManagementCertificate Profile and click Add and enter a profile Name.
- Select a value for the Username Field:
- If you intend for the client certificate to authenticate individual users, select the certificate field that identifies the user.
- If you are deploying the client certificate from the portal, leave this field set to None.
- If you are setting up a certificate profile for use with a pre-logon connect method, leave the field set to None.
- In the CA Certificates area,
click Add and then:
- Select the CA certificate, either a trusted root CA certificate or the CA certificate from a SCEP server. (If necessary, import the certificate).
- (Optional) Enter the Default OCSP URL.
- (Optional) Select a certificate for OCSP Verify CA.
- (Optional) Select options that specify when
to block the user’s requested session:
- Status of certificate is unknown.
- GlobalProtect component does not retrieve certificate status within the number of seconds in Certificate Status Timeout.
- Serial number attribute in the subject of a client certificate does not match the host ID that the GlobalProtect agent reports for the client endpoint.
- Click OK.
- (Optional) Issue
client certificates to GlobalProtect clients and endpoints.To transparently deploy client certificates, configure your portal to distribute a shared client certificate to your endpoints or configure the portal to use SCEP to request and deploy unique client certificates for each user.
- Use your enterprise PKI or a public CA to issue a client certificate to each GlobalProtect user.
- For the pre-logon connect methods, install certificates in the personal certificate store on the client systems.
- Save the GlobalProtect configuration.Click Commit.
Set Up LDAP Authentication
Set Up LDAP Authentication LDAP is often used by organizations as a central repository for user information and as an authentication service. It can also ...
Remote Access VPN with Two-Factor Authentication
Remote Access VPN with Two-Factor Authentication If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can ...
GlobalProtect Portals Authentication Configuration Tab
GlobalProtect Portals Authentication Configuration Tab Select Network GlobalProtect Portals Authentication to configure several different types of GlobalProtect portal settings: An SSL/TLS service profile that the ...
Device > Server Profiles > LDAP
Device > Server Profiles > LDAP Select Device Server Profiles LDAP or Panorama Server Profiles LDAP to configure settings for the Lightweight Directory Access Protocol ...
Remote Access VPN with Pre-Logon
Remote Access VPN with Pre-Logon Pre-logon is a connect method that establishes a VPN tunnel before a user logs in. The purpose of pre-logon is ...
Set Up Authentication Using Custom Certificates Between HA Peers
Set Up Authentication Using Custom Certificates Between HA Peers You can Set Up Authentication Using Custom Certificates for securing the HA connection between Panorama HA ...
Enable Two-Factor Authentication Using Smart Cards
Enable Two-Factor Authentication Using Smart Cards If you want to enable your end users to authenticate using a smart card or common access card (CAC), ...
Deploy Machine Certificates for Authentication
Deploy Machine Certificates for Authentication To confirm that the endpoint belongs to your organization, use your own public-key infrastructure (PKI) to issue and distribute machine ...
Deploy Server Certificates to the GlobalProtect Components
Deploy Server Certificates to the GlobalProtect Components The following table shows the best practice steps for deploying SSL/TLS certificates to the GlobalProtect components: Import a ...