Remote Access VPN (Certificate Profile)

With certificate authentication, the client must present a valid client certificate that identifies the user to the GlobalProtect portal or gateway. In addition to the certificate itself, the portal or gateway can use a certificate profile to determine whether the client that sent the certificate is the client to which the certificate was issued.
When a client certificate is the only means of authentication, the certificate that the client presents must contain the username in one of the certificate fields; typically the username corresponds to the common name (CN) in the Subject field of the certificate.
Upon successful authentication, the GlobalProtect agent establishes a VPN tunnel with the gateway and is assigned an IP address from the IP pool in the gateway’s tunnel configuration. To support user-based policy enforcement on sessions from the corp-vpn zone, the username from the certificate is mapped to the IP address that the gateway assigned. Also, if a security policy requires a domain name in addition to user name, the specified domain value in the certificate profile is appended to the username.
GlobalProtect Client Certificate Authentication Configuration
gp-client-cert-auth.png
This quick configuration uses the same topology as GlobalProtect VPN for Remote Access. The only configuration difference is that instead of authenticating users against an external authentication server, this configuration uses client certificate authentication only.
  1. Use the
    default
    virtual router for all interface configurations to avoid having to create inter-zone routing.
    • Select
      Network
      Interfaces
      Ethernet
      and configure ethernet1/2 as a Layer 3 Ethernet interface with IP address
      203.0.113.1
      and assign it to the l3-untrust security zone and the default virtual router.
    • Create a DNS “A” record that maps IP address
      203.0.113.1
      to
      gp.acme.com
      .
    • Select
      Network
      Interfaces
      Tunnel
      .
    • Add tunnel.2 interface to a new zone called
      corp-vpn
      . Assign the interface to the default virtual router.
    • Enable User Identification on the corp-vpn zone.
  2. Create security policy to enable traffic flow between the corp-vpn zone and the l3-trust zone to enable access to your internal resources.
    1. Select
      Policies
      Security
      and then
      Add
      a new rule.
    2. For this example, you would define the rule with the following settings:
      • Name—
        VPN Access
      • Source Zone—
        corp-vpn
      • Destination Zone—
        l3-trust
      vpn-policy-example.png
  3. Obtain a server certificate for the interface hosting the GlobalProtect portal and gateway using one of the following methods:
    Select
    Device
    Certificate Management
    Certificates
    to manage certificates as follows:
    • Obtain a server certificate. Because the portal and gateway are on the same interface, the same server certificate can be used for both components.
    • The CN of the certificate must match the FQDN,
      gp.acme.com
      .
    • To enable clients to connect to the portal without receiving certificate errors, use a server certificate from a public CA.
    1. Use your enterprise PKI or a public CA to issue a unique client certificate to each GlobalProtect user.
    1. Select
      Device
      Certificate Management
      Certificate Profile
      , click
      Add
      and enter a profile
      Name
      such as
      GP-client-cert
      .
    2. Select
      Subject
      from the
      Username Field
      drop-down.
    3. Click
      Add
      in the CA Certificates section, select the
      CA Certificate
      that issued the client certificates, and click
      OK
      twice.
  4. See the topology diagram shown in GlobalProtect VPN for Remote Access.
    Select
    Network
    GlobalProtect
    Gateways
    and add the following configuration:
    Interface
    ethernet1/2
    IP Address
    203.0.113.1
    Server Certificate
    GP-server-cert.pem issued by GoDaddy
    Certificate Profile
    GP-client-cert
    Tunnel Interface
    tunnel.2
    IP Pool
    10.31.32.3 - 10.31.32.118
  5. Configure the GlobalProtect Portals.
    Select
    Network
    GlobalProtect
    Portals
    and add the following configuration:
    1. Interface
      ethernet1/2
      IP Address
      203.0.113.1
      Server Certificate
      GP-server-cert.pem issued by GoDaddy
      Certificate Profile
      GP-client-cert
    2. Connect Method
      On-demand
      (Manual user initiated connection)
      External Gateway Address
      gp.acme.com
  6. Select
    Device
    GlobalProtect Client
    .
    In this example, use the procedure to Host Agent Updates on the Portal.
  7. (
    Optional
    ) Enable use of the GlobalProtect mobile app.
    Purchase and install a GlobalProtect subscription (
    Device
    Licenses
    ) to enable use of the app.
  8. Save the GlobalProtect configuration.
    Click
    Commit
    .

Related Documentation