Deploy Server Certificates to the GlobalProtect LSVPN Components

The GlobalProtect LSVPN components use SSL/TLS to mutually authenticate. Before deploying the LSVPN, you must assign an SSL/TLS service profile to each portal and gateway. The profile specifies the server certificate and allowed TLS versions for communication with satellites. You don’t need to create SSL/TLS service profiles for the satellites because the portal will issue a server certificate for each satellite during the first connection as part of the satellite registration process.
In addition, you must import the root certificate authority (CA) certificate used to issue the server certificates onto each firewall that you plan to host as a gateway or satellite. Finally, on each gateway and satellite participating in the LSVPN, you must configure a certificate profile that will enable them to establish an SSL/TLS connection using mutual authentication.
The following workflow shows the best practice steps for deploying SSL certificates to the GlobalProtect LSVPN components:
  1. On the firewall hosting the GlobalProtect portal, create the root CA certificate for signing the certificates of the GlobalProtect components.
    1. Select
      Device
      Certificate Management
      Certificates
      Device Certificates
      and click
      Generate
      .
    2. Enter a
      Certificate Name
      , such as
      LSVPN_CA
      .
    3. Do not select a value in the
      Signed By
      field (this is what indicates that it is self-signed).
    4. Select the
      Certificate Authority
      check box and then click
      OK
      to generate the certificate.
  2. Create SSL/TLS service profiles for the GlobalProtect portal and gateways.
    For the portal and each gateway, you must assign an SSL/TLS service profile that references a unique self-signed server certificate.
    The best practice is to issue all of the required certificates on the portal, so that the signing certificate (with the private key) doesn’t have to be exported.
    If the GlobalProtect portal and gateway are on the same firewall interface, you can use the same server certificate for both components.
    1. Use the root CA on the portal to Generate a Certificate for each gateway you will deploy:
      1. Select
        Device
        Certificate Management
        Certificates
        Device Certificates
        and click
        Generate
        .
      2. Enter a
        Certificate Name
        .
      3. Enter the FQDN (
        recommended
        ) or IP address of the interface where you plan to configure the gateway in the
        Common Name
        field.
      4. In the
        Signed By
        field, select the
        LSVPN_CA
        certificate you just created.
      5. In the Certificate Attributes section, click
        Add
        and define the attributes to uniquely identify the gateway. If you add a
        Host Name
        attribute (which populates the SAN field of the certificate), it must exactly match the value you defined for the
        Common Name
        .
      6. Generate
        the certificate.
    2. Configure an SSL/TLS Service Profile for the portal and each gateway:
      1. Select
        Device
        Certificate Management
        SSL/TLS Service Profile
        and click
        Add
        .
      2. Enter a
        Name
        to identify the profile and select the server
        Certificate
        you just created for the portal or gateway.
      3. Define the range of TLS versions (
        Min Version
        to
        Max Version
        ) allowed for communicating with satellites and click
        OK
        .
  3. Deploy the self-signed server certificates to the gateways.
    Best Practices:
    • Export the self-signed server certificates issued by the root CA from the portal and import them onto the gateways.
    • Be sure to issue a unique server certificate for each gateway.
    • The Common Name (CN) and, if applicable, the Subject Alternative Name (SAN) fields of the certificate must match the IP address or fully qualified domain name (FQDN) of the interface where you configure the gateway.
    1. On the portal, select
      Device
      Certificate Management
      Certificates
      Device Certificates
      , select the gateway certificate you want to deploy, and click
      Export
      .
    2. Select
      Encrypted Private Key and Certificate (PKCS12)
      from the
      File Format
      drop-down.
    3. Enter (and re-enter) a
      Passphrase
      to encrypt the private key associated with the certificate and then click
      OK
      to download the PKCS12 file to your computer.
    4. On the gateway, select
      Device
      Certificate Management
      Certificates
      Device Certificates
      and click
      Import
      .
    5. Enter a
      Certificate Name
      .
    6. Enter the path and name to the
      Certificate File
      you just downloaded from the portal, or
      Browse
      to find the file.
    7. Select
      Encrypted Private Key and Certificate (PKCS12)
      as the
      File Format
      .
    8. Enter the path and name to the PKCS12 file in the
      Key File
      field or
      Browse
      to find it.
    9. Enter and re-enter the
      Passphrase
      you used to encrypt the private key when you exported it from the portal and then click
      OK
      to import the certificate and key.
  4. Import the root CA certificate used to issue server certificates for the LSVPN components.
    You must import the root CA certificate onto all gateways and satellites. For security reasons, make sure you export the certificate only, and not the associated private key.
    1. Download the root CA certificate from the portal.
      1. Select
        Device
        Certificate Management
        Certificates
        Device Certificates
        .
      2. Select the root CA certificate used to issue certificates for the LSVPN components and click
        Export
        .
      3. Select
        Base64 Encoded Certificate (PEM)
        from the
        File Format
        drop-down and click
        OK
        to download the certificate. (Do not export the private key.)
    2. On the firewalls hosting the gateways and satellites, import the root CA certificate.
      1. Select
        Device
        Certificate Management
        Certificates
        Device Certificates
        and click
        Import
        .
      2. Enter a
        Certificate Name
        that identifies the certificate as your client CA certificate.
      3. Browse
        to the
        Certificate File
        you downloaded from the CA.
      4. Select
        Base64 Encoded Certificate (PEM)
        as the
        File Format
        and then click
        OK
        .
      5. Select the certificate you just imported on the
        Device Certificates
        tab to open it.
      6. Select
        Trusted Root CA
        and then click
        OK
        .
      7. Commit
        the changes.
  5. Create a certificate profile.
    The GlobalProtect LSVPN portal and each gateway require a certificate profile that specifies which certificate to use to authenticate the satellites.
    1. Select
      Device
      Certificate Management
      Certificate Profile
      and click
      Add
      and enter a profile
      Name
      .
    2. Make sure
      Username Field
      is set to
      None
      .
    3. In the
      CA Certificates
      field, click
      Add
      , select the Trusted Root CA certificate you imported in the previous step.
    4. (
      Recommended
      ) Enable use of CRL and/or OCSP to enable certificate status verification.
    5. Click
      OK
      to save the profile.
  6. Commit your changes.
    Click
    Commit
    .

Related Documentation