Enable Two-Factor Authentication Using Certificate and Authentication Profiles

The following workflow describes how to configure GlobalProtect to require users to authenticate to both a certificate profile and an authentication profile. The user must successfully authenticate using both methods in order to connect to the portal/gateway. For more details on this configuration, see Remote Access VPN with Two-Factor Authentication.
  1. Create an authentication server profile.
    The authentication server profile determines how the firewall connects to an external authentication service and retrieves the authentication credentials for your users.
    If you are using LDAP to connect to Active Directory (AD), you must create a separate LDAP server profile for every AD domain.
    1. Select
      Device
      Server Profiles
      and a profile type (
      LDAP
      ,
      Kerberos
      ,
      RADIUS
      , or
      TACACS⁠+
      ).
    2. Add
      a new server profile.
    3. Enter a
      Profile Name
      , such as
      gp-user-auth
      .
    4. (
      LDAP Only
      ) Select the LDAP server
      Type
      (
      active-directory
      ,
      e-directory
      ,
      sun
      , or
      other
      ).
    5. Click
      Add
      in the
      Servers
      or
      Servers List
      area (depending on the type of server profile), and then enter the following information for connections to the authentication service:
      • Name
        of the server
      • IP address of FQDN of the
        Server
      • Port
    6. (
      RADIUS, TACACS+, and LDAP only
      ) Specify the following settings to enable the firewall to authenticate to the authentication service:
      • RADIUS and TACACS+—Enter the shared
        Secret
        when adding the server entry.
      • LDAP—Enter the
        Bind DN
        and
        Password
        .
    7. (
      LDAP only
      ) If you want the endpoint to use SSL or TLS for a more secure connection with the directory server, enable the option to
      Require SSL/TLS secured connection
      (enabled by default). The protocol that the endpoint uses depends on the server
      Port
      in the
      Server list
      :
      • 389 (default)—TLS (specifically, the endpoint uses the StartTLS operation to upgrade the initial plaintext connection to TLS).
      • 636—SSL.
      • Any other port—The endpoint first attempts to use TLS. If the directory server does not support TLS, the endpoint uses SSL.
    8. (
      LDAP only
      ) For additional security, enable the option to
      Verify Server Certificate for SSL sessions
      so that the endpoint verifies the certificate that the directory server presents for SSL/TLS connections. To enable verification, you also must enable the option to
      Require SSL/TLS secured connection
      . In order for verification to succeed, one of the following conditions must be true:
      • The certificate is in the list of device certificates:
        Device
        Certificate Management
        Certificates
        Device Certificates
        . Import the certificate into the endpoint if necessary.
      • The certificate signer is in the list of trusted certificate authorities:
        Device
        Certificate Management
        Certificates
        Default Trusted Certificate Authorities
        .
    9. Click
      OK
      to save the server profile.
  2. Create an authentication profile that identifies the service for authenticating users. You later have the option of assigning the profile on the portal and gateways.
    1. Select
      Device
      Authentication Profile
      , and then
      Add
      a new profile.
    2. Enter a
      Name
      for the profile.
    3. Select the
      Authentication
      Type
      .
    4. Select the
      Server Profile
      you created in step 1.
    5. (
      LDAP Only
      ) Enter
      sAMAccountName
      as the
      Login Attribute
      .
    6. Click
      OK
      to save the authentication profile.
  3. Create a client certificate profile that the portal uses to authenticate the client certificates that come from user endpoints.
    When you configure two-factor authentication to use client certificates, the external authentication service uses the username value to authenticate the user, if specified, in the client certificate. This ensures that the user who is logging is in is actually the user to whom the certificate was issued.
    1. Select
      Device
      Certificate Management
      Certificate Profile
      , and then
      Add
      a new certificate profile.
    2. Enter a
      Name
      for the profile.
    3. Select one of the following
      Username Field
      values:
      • If you intend for the client certificate to authenticate individual users, select the certificate field that identifies the user.
      • If you are deploying the client certificate from the portal, select
        None
        .
      • If you are setting up a certificate profile for use with a pre-logon connect method, select
        None
        .
    4. Add
      the
      CA Certificates
      that you want to assign to the profile, and then configure the following settings:
      1. Select the
        CA certificate
        , either a trusted root CA certificate or the CA certificate from a SCEP server. If necessary, import the certificate.
      2. (
        Optional
        ) Enter the
        Default OCSP URL
        .
      3. (
        Optional
        ) Select a certificate for
        OCSP Verify Certificate
        .
      4. (
        Optional
        ) Enter the
        Template Name
        for the template that was used to sign the certificate.
    5. (
      Optional
      ) Select the following options to specify when to block the user’s requested session:
      1. Status of certificate is unknown.
      2. GlobalProtect component does not retrieve certificate status within the number of seconds in
        Certificate Status Timeout
        .
      3. Serial number attribute in the subject of a client certificate does not match the host ID that the GlobalProtect app reports for the endpoint.
      4. Certificates have expired.
    6. Click
      OK
      .
  4. To deploy client certificates transparently, configure your portal to distribute a shared client certificate to your endpoints or configure the portal to use SCEP to request and deploy unique client certificates for each user.
    1. Use your enterprise PKI or a public CA to issue a client certificate to each GlobalProtect user.
    2. For the pre-logon connect methods, install certificates in the personal certificate store on the endpoint.
  5. Save the GlobalProtect configuration.
    Click
    Commit
    .

Related Documentation