Deploy Server Certificates to the GlobalProtect LSVPN Components

1. On the firewall hosting the GlobalProtect portal, create the root CA certificate for signing the certificates of the GlobalProtect components.

   Create a Self-Signed Root CA Certificate:

   1. Select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later). Select Generate.
   2. Enter a Certificate Name, such as LSVPN_CA.
   3. Don’t select a value in the Signed By field (this is what indicates that it’s self-signed).
   4. Select the Certificate Authority check box and then click OK to generate the certificate.
2. Create SSL/TLS service profiles for the GlobalProtect portal and gateways.

   For the portal and each gateway, you must assign an SSL/TLS service profile that references a unique self-signed server certificate.

   The best practice is to issue all of the required certificates on the portal, so that the signing certificate (with the private key) doesn’t have to be exported.

   If the GlobalProtect portal and gateway are on the same firewall interface, you can use the same server certificate for both components.

   1. Use the root CA on the portal to generate a certificate for each gateway that you’ll deploy:

      1. Select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later). Select Generate.
      2. Enter a Certificate Name.
      3. Enter the FQDN (recommended) or IP address of the interface where you plan to configure the gateway in the Common Name field.
      4. In the Signed By field, select the LSVPN_CA certificate you created.
      5. In the Certificate Attributes section, click Add and define the attributes to identify the gateway uniquely. If you add a Host Name attribute (which populates the SAN field of the certificate), it must exactly match the value you defined for the Common Name.
      6. Generate the certificate.
   2. Configure an SSL/TLS service profile for the portal and each gateway:

      1. Select DeviceCertificate ManagementSSL/TLS Service Profile and click Add.
      2. Enter a Name to identify the profile and select the server Certificate you created for the portal or gateway.
      3. Define the range of TLS versions (Min Version to Max Version) allowed for communicating with satellites and click OK.
3. Deploy the self-signed server certificates to the gateways.

   Best Practices:

   • Export the self-signed server certificates issued by the root CA from the portal and import them onto the gateways.
   • Be sure to issue a unique server certificate for each gateway.
   • The Common Name (CN) and, if applicable, the Subject Alternative Name (SAN) fields of the certificate must match the IP address or FQDN of the interface where you configure the gateway.

   1. On the portal, select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later). Select the gateway certificate you want to deploy, and click Export.
   2. Select Encrypted Private Key and Certificate (PKCS12) from the File Format drop-down.
   3. Enter (and re-enter) a Passphrase to encrypt the private key associated with the certificate and then click OK to download the PKCS12 file to your computer.
   4. On the gateway, select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later). Select Import.
   5. Enter a Certificate Name.
   6. Enter the path and name to the Certificate File that you downloaded from the portal, or Browse to find the file.
   7. Select Encrypted Private Key and Certificate (PKCS12) as the File Format.
   8. Enter the path and name to the PKCS12 file in the Key File field or Browse to find it.
   9. Enter and re-enter the Passphrase you used to encrypt the private key when you exported it from the portal and then click OK to import the certificate and key.
4. Import the root CA certificate used to issue server certificates for the LSVPN components.

   Import the root CA certificate onto all gateways and satellites. For security reasons, make sure you export the certificate only, and not the associated private key.

   1. Download the root CA certificate from the portal.

      1. Select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later).
      2. Select the root CA certificate used to issue certificates for the LSVPN components and click Export.
      3. Select Base64 Encoded Certificate (PEM) from the File Format drop-down and click OK to download the certificate. (Do not export the private key.)
   2. On the firewalls hosting the gateways and satellites, import the root CA certificate.

      1. Select DeviceCertificate ManagementCertificates, then Device Certificates (PAN-OS 11.2 and earlier) or Custom Certificates (PAN-OS 12.1.0 and later). Select Import.
      2. Enter a Certificate Name that identifies the certificate as your client CA certificate.
      3. Browse to the Certificate File you downloaded from the CA.
      4. Select Base64 Encoded Certificate (PEM) as the File Format and then click OK.
      5. Select the certificate you imported on the Device Certificates or Custom Certificates tab to open it.
      6. Select Trusted Root CA and then click OK.
      7. Commit the changes.
5. Create a Certificate Profile.

   The GlobalProtect LSVPN portal and each gateway require a Certificate Profile that specifies which certificate to use to authenticate the satellites.

   1. Select DeviceCertificate ManagementCertificate Profile and click Add and enter a profile Name.
   2. Make sure that the Username Field is set to None.
   3. In the CA Certificates field, click Add, select the trusted root CA certificate you imported in the previous step.
   4. (Recommended) Enable use of CRL and/or OCSP to enable certificate status verification.
   5. Click OK to save the profile.
6. Commit your changes.

   Click Commit.