GlobalProtect Gateway Authentication Tab
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
End-of-Life (EoL)
GlobalProtect Gateway Authentication Tab
- NetworkGlobalProtectGateways<gateway-config>Authentication
Select the Authentication tab to identify
the SSL/TLS service profile and to configure the details of client
authentication. You can add multiple client authentication configurations.
GlobalProtect
Gateway Authentication Settings | |
---|---|
SSL/TLS Service Profile | Select an SSL/TLS service profile for securing
this GlobalProtect gateway. For details about the contents of a service
profile, see Device
> Certificate Management > SSL/TLS Service Profile. |
Client Authentication Area | |
Name | Enter a unique name to identify this configuration. |
OS | By default, the configuration applies to
all endpoints. You can refine the list of endpoints by OS (Android, Chrome, iOS, IoT, Linux, Mac, Windows,
or WindowsUWP), by Satellite devices,
or by third-party IPSec VPN clients (X-Auth). The
OS is the main differentiator between multiple configurations. If
you need multiple configurations for one OS, you can further distinguish
the configurations by your choice of authentication profile. Order the configurations from most specific
at the top of the list to most general at the bottom. |
Authentication Profile | Choose an authentication profile or sequence
from the drop-down to authenticate access to the gateway. Refer
to Device
> Authentication Profile. For client authentication,
ensure that the Authentication Profile uses RADIUS or SAML with two-factor
authentication. If you don’t use RADIUS or SAML, then you need to
configure a Certificate profile in
addition to an Authentication Profile. |
Username Label | Specify a custom username label for GlobalProtect gateway
login. For example, Username (only) or Email Address (username@domain). |
Password Label | Specify a custom password label for GlobalProtect gateway
login. For example, Password (Turkish) or Passcode (for
two-factor, token-based authentication). |
Authentication Message | To help end users know what credentials
they should use for logging into this gateway, you can enter a message
or keep the default message. The message can have a maximum of 256
characters. |
Allow Authentication with User Credentials
OR Client Certificate | If you select No,
users must authenticate to the gateway using both user credentials
and client certificates. If you select Yes,
users can authenticate to the gateway using either user credentials
or client certificates. |
Certificate Profile | |
Certificate Profile | (Optional) Select the Certificate
Profile the gateway uses to match those client certificates
that come from user endpoints. With a Certificate Profile, the gateway authenticates
the user only if the certificate from the client matches this profile. If
you set the Allow Authentication with User Credentials
OR Client Certificate option to No,
you must select a Certificate Profile. If
you set the Allow Authentication with User Credentials
OR Client Certificate option to Yes,
the Certificate Profile is optional. The
certificate profile is independent of the OS. |
Block login for quarantined devices | Specify whether to block gateway login for GlobalProtect
client devices that are in the quarantine list (DeviceDevice Quarantine). |