Click File and click on Add/Remove Snap-in and click on Certificates.Open the Console Certificate Store by pressing the Start Menu and typing "mmc".Note: If using a Third Party Certificate source, importing the Root CA will not be necessary as it should already be trusted. Export the Client Cert as PKCS12 with key.Export the Server Certificate as PEM without key.Note: You can optionally have an Authentication Profile in your configuration. Add the Certificate Profile to the Gateway.Click on Client Configuration tab in the Portal configuration and make sure to list the Root-CA under the Trusted Root Section.The commit will fail if GlobalProtect is configured with just a certificate profile as authentication, where the username in the profile is "none". T his will only work when the certificate profile has the username configured. Click on your Portal Configuration and add the Certificate Profile to the GlobalProtect Portal.Note: The client cert name does not matter here as long as it gets imported into the host machines correctly and is signed by the Root-CA.Ĭlick Add and add the Root-CA in the profile.The Client Cert also signed by the Root-CA with the Common Name Client Certificate.Certificate CN name and address the client queries should be the same. Note: FQDN will be used for Common name instead of IP if listing FQDN in the configuration for Gateway addresses.The Server Cert signed by the Root-CA with the Subject name which matches the address IP that the client will query for the GlobalProtect Portal and Gateway connections.Client Certificate used to import on the clients when you want to use a Client Certificate for Authentication as well or alone.Server Certificate used for the the connections to the GlobalProtect Portal and Gateway.The self-signed Certificate "Root-CA" that will be used to sign the following:.The screenshot above shows the following:
Refer to the TechDocs GlobalProtect admin guide for basic GlobalProtect configuration: GlobalProtect Administrator's Guide (Note: please choose your version from the drop down on the left side of the page) The example applied in this document is done with self-signed certificates, but it can also be done with an internal CA store. This document describes the steps to configure GlobalProtect with a client certificate profile when using a client certificate for authentication with or without other authentication methods.
0 kommentar(er)
