Deploy Server Certificates to the GlobalProtect LSVPN Components
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
Deploy Server Certificates to the GlobalProtect LSVPN Components
The GlobalProtect LSVPN components use SSL/TLS to authenticate mutually. Before deploying the
LSVPN, you must assign an SSL/TLS service profile to each portal and gateway. The
profile specifies the server certificate and allowed TLS versions for communication
with satellites. You don’t need to create SSL/TLS service profiles for the
satellites because the portal will issue a server certificate for each satellite
during the first connection as part of the satellite registration process.
In addition, you must import the root
certificate authority (CA) certificate used to issue the server
certificates onto each firewall that you plan to host as a gateway or
satellite. Finally, on each gateway and satellite participating
in the LSVPN, you must configure a certificate profile that will
enable them to establish an SSL/TLS connection using mutual authentication.
The
following workflow shows the best practice steps for deploying SSL
certificates to the GlobalProtect LSVPN components:
- On the firewall hosting the GlobalProtect portal, create the root CA certificate for signing the certificates of the GlobalProtect components.
- Selectand clickDeviceCertificate ManagementCertificatesDevice CertificatesGenerate.
- Enter aCertificate Name, such asLSVPN_CA.
- Don’t select a value in theSigned Byfield (this is what indicates that it’s self-signed).
- Select theCertificate Authoritycheck box and then clickOKto generate the certificate.
- Create SSL/TLS service profiles for the GlobalProtect portal and gateways.For the portal and each gateway, you must assign an SSL/TLS service profile that references a unique self-signed server certificate.The best practice is to issue all of the required certificates on the portal, so that the signing certificate (with the private key) doesn’t have to be exported.If the GlobalProtect portal and gateway are on the same firewall interface, you can use the same server certificate for both components.
- Use the root CA on the portal to Generate a Certificate for each gateway that you’ll deploy:
- Selectand clickDeviceCertificate ManagementCertificatesDevice CertificatesGenerate.
- Enter aCertificate Name.
- Enter the FQDN (recommended) or IP address of the interface where you plan to configure the gateway in theCommon Namefield.
- In theSigned Byfield, select theLSVPN_CAcertificate you created.
- In the Certificate Attributes section, clickAddand define the attributes to identify the gateway uniquely. If you add aHost Nameattribute (which populates the SAN field of the certificate), it must exactly match the value you defined for theCommon Name.
- Generatethe certificate.
- Configure an SSL/TLS Service Profile for the portal and each gateway:
- Selectand clickDeviceCertificate ManagementSSL/TLS Service ProfileAdd.
- Enter aNameto identify the profile and select the serverCertificateyou created for the portal or gateway.
- Define the range of TLS versions (Min VersiontoMax Version) allowed for communicating with satellites and clickOK.
- Deploy the self-signed server certificates to the gateways.Best Practices:
- Export the self-signed server certificates issued by the root CA from the portal and import them onto the gateways.
- Be sure to issue a unique server certificate for each gateway.
- The Common Name (CN) and, if applicable, the Subject Alternative Name (SAN) fields of the certificate must match the IP address or FQDN of the interface where you configure the gateway.
- On the portal, select, select the gateway certificate you want to deploy, and clickDeviceCertificate ManagementCertificatesDevice CertificatesExport.
- SelectEncrypted Private Key and Certificate (PKCS12)from theFile Formatdrop-down.
- Enter (and re-enter) aPassphraseto encrypt the private key associated with the certificate and then clickOKto download the PKCS12 file to your computer.
- On the gateway, selectand clickDeviceCertificate ManagementCertificatesDevice CertificatesImport.
- Enter aCertificate Name.
- Enter the path and name to theCertificate Filethat you downloaded from the portal, orBrowseto find the file.
- SelectEncrypted Private Key and Certificate (PKCS12)as theFile Format.
- Enter the path and name to the PKCS12 file in theKey Filefield orBrowseto find it.
- Enter and re-enter thePassphraseyou used to encrypt the private key when you exported it from the portal and then clickOKto import the certificate and key.
- Import the root CA certificate used to issue server certificates for the LSVPN components.Import the root CA certificate onto all gateways and satellites. For security reasons, make sure you export the certificate only, and not the associated private key.
- Download the root CA certificate from the portal.
- Select.DeviceCertificate ManagementCertificatesDevice Certificates
- Select the root CA certificate used to issue certificates for the LSVPN components and clickExport.
- SelectBase64 Encoded Certificate (PEM)from theFile Formatdrop-down and clickOKto download the certificate. (Do not export the private key.)
- On the firewalls hosting the gateways and satellites, import the root CA certificate.
- Selectand clickDeviceCertificate ManagementCertificatesDevice CertificatesImport.
- Enter aCertificate Namethat identifies the certificate as your client CA certificate.
- Browseto theCertificate Fileyou downloaded from the CA.
- SelectBase64 Encoded Certificate (PEM)as theFile Formatand then clickOK.
- Select the certificate you imported on theDevice Certificatestab to open it.
- SelectTrusted Root CAand then clickOK.
- Committhe changes.
- Create a Certificate Profile.The GlobalProtect LSVPN portal and each gateway require a Certificate Profile that specifies which certificate to use to authenticate the satellites.
- Selectand clickDeviceCertificate ManagementCertificate ProfileAddand enter a profileName.
- Make sure that theUsername Fieldis set toNone.
- In theCA Certificatesfield, clickAdd, select the trusted root CA certificate you imported in the previous step.
- (Recommended) Enable use of CRL and/or OCSP to enable certificate status verification.
- ClickOKto save the profile.
- Commit your changes.ClickCommit.