How to configure GlobalProtect VPN using an external Root CA

• Panorama
• 10.50.1.50

• Firewall
• Management interface: 10.50.1.10
• Untrust interface: 42.11.45.1/24
• DMZ interface: 172.16.45.1/24
• Web Server (behind DMZ): 172.16.45.50

• Windows Server 2012
• 172.16.45.50

• Windows 7 PC
• 192.168.45.10

• Verify the Windows Server 2012 has Active Directory installed and running with groups and users created on it.
• Configure/verify that DNS is fully working between the following IP Addresses and systems (forward and reverse) (i.e. make sure nslookup works):
• Windows 7 PC
• Windows Server 2012 
• PAN Firewall
• (i.e. Windows 7 PC must be able to nslookup the Outside interface IP address of the PAN firewall and resolve to the FQDN of the firewall in a browser)

1. Install Certificate Services on Windows Server 2012 (i.e. make Windows Server 2012 the Root CA)
2. Export the Root CA Certificate from the Windows Server 2012 Root CA
3. Install the Root CA Certificate on employee Windows/Mac PCs
4. Import Root CA Certificate into firewall, generate CSR on firewall, get CSR signed by Windows Server 2012 Root CA, and then install that signed certificate on the firewall
5. Configure GlobalProtect on the Firewall and configure Security Policy rule to allow VPN traffic from Outside to Inside/DMZ
6. Download/Activate GlobalProtect client software images which the Firewall will serve to the employee Windows/Mac PCs 
7. Download, install, and connect to the firewall using GlobalProtect VPN client software on employee Windows/Mac PCs
8. Troubleshooting/Verification/Debugs

1. Open Server Manager > click Add roles and Features

2. Click Role-based and click Next

3. Select the Windows Server and click Next

4. Select Active Directory Certificate Services and click Next

5. Click Next twice

6. Select Certification Authority Web Enrollment and click Next twice

7. Click Next

8. Check the Restart the destination server automatically if required checkbox and click Install

9. Once the loading bar is done above, click Configure Active Directory Certificate Services on the destination server

10. Click Next

11. Check Certification Authority and Certification Authority Web Enrollment and click Next twice

12. Select Root CA and click Next

13. Select Create a new private key and click Next

14. Select SHA256 as the hash algorithm which this Windows Server 2012 Root CA will use to sign certificates (most modern browsers will show warnings for anything below SHA256) - click Next

15. Save this information to a notepad - click Next until the next step (Confirmation screen)

16. Click Configure

17. Launch a web browser and go to http://172.16.45.50/certsrv - type in the Administrator credentials for Windows Server 2012

18. Now the Windows Server 2012 is a Root CA. Now, it can sign CSRs submitted to it - Windows Server 2012 will take the CSR and give back a signed certificate in return (i.e. that certificate will be signed by Windows Server 2012 which is the Root CA)

1. Click Download a CA certificate, certificate chain, or CRL

2. Click Download CA Certificate

3. Rename it to RootCACert

1. Put the RootCACert file on the Windows 7 client PC and double-click to install the certificate:

2. Click Next

3. Select Place all certificates in the following store - click Browse and select the Trusted Root Certification Authorities folder - click Ok and Next and click Finish

 

1. Go to http://172.16.45.50/certsrv and click Download a CA Certificate, certificate chain, or CRL

2. Select Base 64 > click Download CA Certificate

3. Rename it to RootCACertFW

4. Go to Panorama or the Firewall and go to Device > Certificate Management > Certificates > click Import
5. Type a Certificate Name for the Root CA Certificate
6. Select the RootCACertFW certificate we just downloaded
7. Select the File Format as Base64 Encoded Certificate (PEM)
8. Click Ok

Note: If you have an Intermediate Root CA Certificate, import it here now under the Root CA Certificate

9. Go to Panorama or the Firewall and go to Device > Certificate Management > Certificates and click Generate
10. Type the Certificate Name for the certificate as GPPortalGatewayCert (this field will be important later - remember the Certificate Name)
11. Type the Common Name as the Outside IP Address of the firewall (or whatever DNS name that IP Address nslookup's to if on internet)
12. Select the Signed By option as 'External Authority (CSR)'
13. Click Add to add a SAN field (IP) to the certificate - this IP/SAN field must match the firewall's FQDN and must be resolvable by the employee PC's in order to connect to the firewall's portal and gateway via the GlobalProtect VPN client
14. Click Generate

 

 

15. Select the checkbox for the CSR and click Export Certificate - the certificate will download to the PC

 

16. Launch a web browser and go to http://172.16.45.50/certsrv
17. Click Request a Certificate

18. Click Advanced Certificate Request

19. Open cert_GPPortalGatewayCert.csr using Notepad - copy and paste the contents into the field like below:
20. Select Certificate Template Web Server
21. Click Submit

22. Select Base 64 encoded
23. Click Download Certificate

Note: When importing this signed cert, it must have the exact same name as the CSR (Certificate Name field) we generated in the Firewall Web UI above i.e. it must be named GPPortalGatewayCert

24. Open Panorama again and go to Device > Certificate Management > Certificates > checkbox the existing CSR and click Import 
25. Type the Certificate Name
26. Click Browse and select GPPortalGatewayCert.cer
27. Select the File Format as Base64 Encoded Certificate (PEM)
28. Click Ok

At this point, the firewall has a Root CA Certificate RootCACertFW, and the firewall has a Firewall Server Certificate GPPortalGatewayCert which is signed by that Root CA Certificate.
 
This Firewall Server Certificate is the certificate which will be presented to the Client PCs when they connect to the firewall via GlobalProtect. The Client PCs will trust this certificate because the client PC also trusts this Root CA due to the step we did earlier in this document where we installed the Root CA Certificate on the Windows 7 Client PC




Configure GlobalProtect on the Firewall and configure Security Policy rule to allow the VPN traffic from Outside to Inside/DMZ

1. Go to Device > Certificate Management > SSL/TLS Service Profile and create an SSL/TLS Service Profile referencing the signed Firewall Server Certificate GPPortalGatewayCert, which we got signed and imported in the above step:

2. Go to Device > Server Profiles > LDAP > click Add
3. Type a Profile Name
4. Under Server List > click Add and type the IP address of the Windows Active Directory (LDAP server) and port 389 for LDAP
5. Click Ok

6. Navigate to Device > Authentication Profile > click Add 
7. Type a Name
8. Select Type LDAP
9. Select Server Profile created above panlabDCldapserverprof
10. Type Login Attribute as sAMAccountName

11. Click Advanced tab > click Add and add 'all' or select certain groups if GlobalProtect VPN should restrict access to certain AD/LDAP groups only

12. Create a tunnel interface to use for GlobalProtect VPN and give it a tunnel number
13. Select the Virtual Router
14. Select a Security Zone - it is recommended to create a separate Security Zone for VPN traffic as it gives more flexibility in creating Security Policy for the VPN traffic
15. Click Ok

16. Go to Network > GlobalProtect > Portals > click Add > General tab
17. Select which Interface and IP address which is to be the GlobalProtect Portal that the Client PC's will connect to

18. From the Authentication tab
19. Select the SSL/TLS Service Profile created above
20. Click Add under Client Authentication
21. Type a Name
22. Select the Authentication Profile we made above
23. Select Yes (User Credentials OR Client Certificate Required)
24. Click Ok

 

25. From the Agent tab
26. Click Add under Agent
27. Under Authentication tab type a Name

28. Under External Gateways tab click Add
29. Type a Name
30. Enter the FQDN of the Firewall which was put in the certificate's SAN/Host Name field earlier in this document (in GPPortalGatewayCert)

31. Under the App tab select Connect Method drop-down and select On-demand (Manual user initiated connection)

32. Click Ok
33. Click Add to add RootCACertFW (imported into the Firewall earlier in this document) to the list of Trusted Root CAs for the GlobalProtect Portal

Note: If you have an Intermediate CA Certificate, add it here below the Root CA Certificate

34. Click Ok
35. From Configure GlobalProtect Gateway
36. Type a Name

37. Select an SSL/TLS Service Profile
38. Under Client Authentication, click Add

39. Type a Name
40. Select the Authentication Profile created earlier in the step above
41. Select Yes (User Credentials OR Client Certificate Required)

42. Click Ok
43. Select the Tunnel Interface created for this GlobalProtect configuration earlier in this document
44. Select the checkbox 'Enable IPSec' - if GlobalProtect fails to connect to the Firewall over IPSec, it will fall back to SSL

45. Under Client Settings tab click Add

46. Type a Name

47. Type a pool of IP addresses which will be the IP addresses the GlobalProtect Client PC's will receive as an IP Address on their GlobalProtect VPN adapter on their PC when they connect via the GlobalProtect VPN Agent

48. Click Ok

1. Go to Panorama/Firewall Web UI and go to Panorama tab > Device Deployment > click GlobalProtect Client
2. Click Download and click Activate on whichever version of GlobalProtect software the end users will use. This will also be the version which the Firewall gives to the Client PC's if they go to the Portal page of the Firewall and download GlobalProtect for use.

 

 

1. Have the end user go to https://fw1.panlab.com and login using their credentials

2. The end user will see a screen like this where they can choose which GlobalProtect software they would like to download and install:

3. Click Connect

4. Have the end user type their credentials and click Sign In

5. The Client PC is now successfully connected into the corporate network via GlobalProtect VPN:

6. The Client PC is connected via GlobalProtect VPN to the firewall over the internet, and the Client PC can reach a web server behind the DMZ interface/zone of the firewall successfully now that he is VPN'd:

• From the Client PC
• From the GlobalProtect Agent
• From the Firewall

1. Make sure the end user's PC can reach the firewall's Outside interface by its FQDN - and that it resolves to the correct IP address

2. Open GlobalProtect on the client PC > click the top-right three-bars icon in GlobalProtect > click Settings

 

 

1. Go to Settings > Troubleshooting tab > Collect Logs > unzip them and open > PanGPA.log
2. Logs of the new GlobalProtect 5.0.4 software downloading and installing:

1. Go to Monitor > Logs > System Logs

admin@PA-VM2(active)> show global-protect-gateway gateway name panlab_Gateway
GlobalProtect Gateway: panlab_Gateway (1 users)
Tunnel Type          : remote user tunnel
Tunnel Name          : panlab_Gateway-N
        VSYS                       : vsys1 (id 1)
        Tunnel ID                  : 3
        Tunnel Interface           : tunnel.2
        Tunnel IPv6 Enabled        : no
        Encap Interface            : ethernet1/4
        vr-id                      : 0
        Inheritance From           :
        Local Address (IPv4)       : 42.11.45.1
        SSL Server Port            : 443
        IPSec Encap                : yes
        Tunnel Negotiation         : ssl
        HTTP Redirect              : no
        UDP Port                   : 4501
        Max Users                  : 0
        Exclude Video Traffic      : no
        Gateway-Level IP Pool Ranges:
        Gateway-Level IP Pool index:     0
        Gateway-Level IPv6 Pool Ranges:
        Gateway-Level IPv6 Pool index:     0
        config name                : panlab_GWClientSettings
        User Groups                :     any;
        OS                         :     any;
        IP Pool Ranges             :     192.168.1.50 - 192.168.1.250(192.168.1.51);
        IP Pool index              :     0
        IPv6 Pool Ranges           :
        IPv6 Pool index            :     0
        No Direct Access To Local Network:     no
        Retrieve Framed IP Address :     no
        Auth Server IP Pool Ranges :
        Auth Server IPv6 Pool Ranges:
        Access Routes              :     0.0.0.0/0
        Exclude Access Routes      :
        DNS Servers                :
        DNS Suffix                 :
        DNS Servers                :
        WINS Servers               :
        SSL Server Cert            : GPPortalGatewayCert
        Client Authentication      :    Auth Name                  : panlab_GwClientAuth
        Auth OS                    : Any
        Auth Profile               : panlabLDAP_authprof
        Allow User Credentials OR Client Cert: yes
        Client Cert Profile        :
        Lifetime                   : 2592000 seconds
        Idle Timeout               : 10800 seconds
        Disconnect On Idle         : 10800 seconds
        Disallow Automatic Restoration: no
        Source IP Check            : no
        Encryption                 : aes-128-cbc
        Authentication             : sha1
 
admin@PA-VM2(active)> show global-protect-gateway current-user gateway panlab_Gateway
admin@PA-VM2(active)> show global-protect-gateway current-user user jsmith
2019-09-15 11:15:49
GlobalProtect Gateway: panlab_Gateway (1 users)
Tunnel Name          : panlab_Gateway-N
        Domain-User Name           : \jsmith
        Computer                   : COMP-WIN7-2
        Primary Username           : jsmith
        Region for Config          : KR
        Source Region              : KR
        Client                     : Microsoft Windows 7 Enterprise Edition Service Pack 1, 64-bit
        VPN Type                   : Device Level VPN
        Mobile ID                  :
        Client OS                  : Windows
        Private IP                 : 192.168.1.50
        Private IPv6               : ::
        Public IP (connected)      : 42.11.45.10
        Public IPv6                : ::
        Client IP                  : 42.11.45.10
        ESP                        : exist
        SSL                        : none
        Login Time                 : Sep.15 11:07:18
        Logout/Expiration          : Oct.15 11:07:18
        TTL                        : 2591489
        Inactivity TTL             : 10302
        Request - Login            : 2019-09-15 11:07:18.254 (1568570838254), 42.11.45.10
        Request - GetConfig        : 2019-09-15 11:07:18.396 (1568570838396), 42.11.45.10
        Request - SSLVPNCONNECT    :  (0), ::
 
admin@PA-VM2(active)> less mp-log rasmgr.log
2019-09-15 11:07:18.208 -0700 req->portal address 0x7fffdc096250
2019-09-15 11:07:18.251 -0700 192.168.1.50 is framed ip? no
2019-09-15 11:07:18.251 -0700 retrieve-framed-ip-address(no);  is-preferred-ip-a-framed-ip(no); retrieve-framed-ip-address-v6(no);  is-preferred-ip-a-framed-ipv6(no);
2019-09-15 11:07:18.252 -0700 req->portal address 0x7fffd8064ca0
2019-09-15 11:07:18.254 -0700 new cookie:  ******
2019-09-15 11:07:18.254 -0700 rasmgr_sslvpn_client_register space panlab_Gateway-N domain  user jsmith computer COMP-WIN7-2 result 0
2019-09-15 11:07:18.396 -0700 client existing address 42.11.45.10/24; preferred ip 192.168.1.50; address-v6 2002::/16,1234:1234:2d0a::1234:1234/128; preferred ipv6 None; client exclude video support yes; gw license no
2019-09-15 11:07:18.397 -0700 Adding info in usr info to haremoteusr info for:jsmith
2019-09-15 11:07:18.397 -0700 Installing GW Tunnel, indicate to keymgr...exclude_video_traffic_enable=0 [0 0]
2019-09-15 11:07:31.066 -0700 Adding info in usr info to haremoteusr info for:jsmith
 
admin@PA-VM2(active)> less appweb-log sslvpn-access.log
42.11.45.1 - - [Sun Sep 15 11:07:18 2019 PDT] "POST /ssl-vpn/prelogin.esp?kerberos-support=yes&tmp=tmp&clientVer=4100&host-id=433474f9-7a92-4f6f-9990-43731e8697fe&clientos=Windows&os-version=Microsoft+Windows+7+Enterprise+Edition+Service+Pack+1%2c+64-bit&ipv6-support=yes HTTP/1.1" 200 968
42.11.45.1 - - [Sun Sep 15 11:07:18 2019 PDT] "POST /ssl-vpn/login.esp HTTP/1.1" 200 2840
42.11.45.1 - - [Sun Sep 15 11:07:18 2019 PDT] "POST /ssl-vpn/getconfig.esp HTTP/1.1" 200 1809
42.11.45.1 - - [Sun Sep 15 11:07:31 2019 PDT] "POST /ssl-vpn/hipreportcheck.esp HTTP/1.1" 200 561
127.0.0.1 - - [Sun Sep 15 11:08:06 2019 PDT] "GET /robots.txt HTTP/1.1" 200 250
 
admin@PA-VM2(active)> show global-protect-gateway flow
total GlobalProtect-Gateway tunnel shown:                     2
id    name                  local-i/f         local-ip                      tunnel-i/f
--    ----                  ---------         --------                      ----------
3     panlab_Gateway-N      ethernet1/4       42.11.45.1                    tunnel.2
 
admin@PA-VM2(active)> show global-protect-gateway flow name panlab_Gateway
2019-09-15 11:18:38
        id:                3
        type:              GlobalProtect-Gateway
        local ip:          42.11.45.1
        inner interface:   tunnel.2         outer interface:  ethernet1/4
        ssl cert:          GPPortalGatewayCert
        active users:      1
assigned-ip                              remote-ip                                MTU   encapsulation
----------------------------------------------------------------------------------------------------------------------
192.168.1.50                             42.11.45.10                              1420  IPSec SPI 4311646B (context 619)
 
admin@PA-VM2(active)> show global-protect-gateway flow tunnel-id 3
tunnel  panlab_Gateway-N
        id:                3
        type:              GlobalProtect-Gateway
        local ip:          42.11.45.1
        inner interface:   tunnel.2         outer interface:  ethernet1/4
        ssl cert:          GPPortalGatewayCert
        active users:      1
assigned-ip                              remote-ip                                MTU   encapsulation
----------------------------------------------------------------------------------------------------------------------
192.168.1.50                             42.11.45.10                              1420  IPSec SPI 4311646B (context 619)