Enable Two-Factor Authentication Using Certificate and Authentication Profiles
The following workflow describes how to configure GlobalProtect to require users to authenticate to both a certificate profile and an authentication profile. The user must successfully authenticate using both methods in order to connect to the portal/gateway. For more details on this configuration, see Remote Access VPN with Two-Factor Authentication.
- Create an authentication server profile.The authentication server profile determines how the firewall connects to an external authentication service and retrieves the authentication credentials for your users.If you are using LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
- Selectand a profile type (DeviceServer ProfilesLDAP,Kerberos,RADIUS, orTACACS+).
- Adda new server profile.
- Enter aProfile Name, such asgp-user-auth.
- (LDAP Only) Select the LDAP serverType(active-directory,e-directory,sun, orother).
- ClickAddin theServersorServers Listarea (depending on the type of server profile), and then enter the following information for connections to the authentication service:
- Nameof the server
- IP address of FQDN of theServer
- (RADIUS, TACACS+, and LDAP only) Specify the following settings to enable the firewall to authenticate to the authentication service:
- RADIUS and TACACS+—Enter the sharedSecretwhen adding the server entry.
- LDAP—Enter theBind DNandPassword.
- (LDAP only) If you want the endpoint to use SSL or TLS for a more secure connection with the directory server, enable the option toRequire SSL/TLS secured connection(enabled by default). The protocol that the endpoint uses depends on the serverPortin theServer list:
- Any other port—The endpoint first attempts to use TLS. If the directory server does not support TLS, the endpoint uses SSL.
- (LDAP only) For additional security, enable the option toVerify Server Certificate for SSL sessionsso that the endpoint verifies the certificate that the directory server presents for SSL/TLS connections. To enable verification, you also must enable the option toRequire SSL/TLS secured connection. In order for verification to succeed, one of the following conditions must be true:
- The certificate is in the list of device certificates:. Import the certificate into the endpoint if necessary.DeviceCertificate ManagementCertificatesDevice Certificates
- The certificate signer is in the list of trusted certificate authorities:.DeviceCertificate ManagementCertificatesDefault Trusted Certificate Authorities
- ClickOKto save the server profile.
- Create an authentication profile that identifies the service for authenticating users. You later have the option of assigning the profile on the portal and gateways.
- Select, and thenDeviceAuthentication ProfileAdda new profile.
- Enter aNamefor the profile.
- Select theAuthenticationType.
- Select theServer Profileyou created in step 1.
- (LDAP Only) EntersAMAccountNameas theLogin Attribute.
- ClickOKto save the authentication profile.
- Create a client certificate profile that the portal uses to authenticate the client certificates that come from user endpoints.When you configure two-factor authentication to use client certificates, the external authentication service uses the username value to authenticate the user, if specified, in the client certificate. This ensures that the user who is logging is in is actually the user to whom the certificate was issued.
- Select, and thenDeviceCertificate ManagementCertificate ProfileAdda new certificate profile.
- Enter aNamefor the profile.
- Select one of the followingUsername Fieldvalues:
- If you intend for the client certificate to authenticate individual users, select the certificate field that identifies the user.
- If you are deploying the client certificate from the portal, selectNone.
- If you are setting up a certificate profile for use with a pre-logon connect method, selectNone.
- AddtheCA Certificatesthat you want to assign to the profile, and then configure the following settings:
- Select theCA certificate, either a trusted root CA certificate or the CA certificate from a SCEP server. If necessary, import the certificate.
- (Optional) Enter theDefault OCSP URL.
- (Optional) Select a certificate forOCSP Verify Certificate.
- (Optional) Enter theTemplate Namefor the template that was used to sign the certificate.
- (Optional) Select the following options to specify when to block the user’s requested session:
- Status of certificate is unknown.
- GlobalProtect component does not retrieve certificate status within the number of seconds inCertificate Status Timeout.
- Certificates have expired.
- To deploy client certificates transparently, configure your portal to distribute a shared client certificate to your endpoints or configure the portal to use SCEP to request and deploy unique client certificates for each user.
- Use your enterprise PKI or a public CA to issue a client certificate to each GlobalProtect user.
- For the pre-logon connect methods, install certificates in the personal certificate store on the endpoint.
- Save the GlobalProtect configuration.ClickCommit.
Set Up LDAP Authentication
Set Up LDAP Authentication LDAP is often used by organizations as an authentication service and a central repository for user information. It can also be ...
Remote Access VPN with Two-Factor Authentication
Remote Access VPN with Two-Factor Authentication If you configure a GlobalProtect portal or gateway with an authentication profile and a certificate profile (which together can ...
Remote Access VPN with Pre-Logon
Remote Access VPN with Pre-Logon Pre-logon is a connect method that establishes a VPN tunnel before a user logs in. The purpose of pre-logon is ...
Configure LDAP Authentication
Configure LDAP Authentication You can use LDAP to authenticate end users who access applications or services through Captive Portal and authenticate firewall or Panorama administrators ...
Deploy Machine Certificates for Authentication
Deploy Machine Certificates for Authentication To confirm that the endpoint belongs to your organization, use your own public-key infrastructure (PKI) to issue and distribute machine ...
Enable Two-Factor Authentication Using Smart Cards
Enable Two-Factor Authentication Using Smart Cards If you want to enable your end users to authenticate using a smart card or common access card (CAC), ...
Define the GlobalProtect Client Authentication Configurations
Define the GlobalProtect Client Authentication Configurations Each GlobalProtect client authentication configuration specifies the settings that enable the user to authenticate with the GlobalProtect portal. You ...
Mixed Authentication Method Support for Certificates or User Credentials
A single GlobalProtect portal or gateway can now support multiple combinations of authentication methods with user credentials and/or client certificates. ...
GlobalProtect Gateway Authentication Tab
GlobalProtect Gateway Authentication Tab Network GlobalProtect Gateways Authentication Select the Authentication tab to identify the SSL/TLS service profile and to configure the details of client ...