Clientless GP Authentication failing using EAP on RAIDUS Server

• GlobalProtect Clientless VPN configured to authenticate via Extensible Authentication Protocol (EAP) for RADIUS
• Certificate error's when looking at the authd.log from the Firewall CLI

2021-05-10 16:58:48.745 +0800 Error:  EapolStatusCb(pan_auth_eapol.c:998): (AId:6751996388145100014) Certificate error (unable to get local issuer certificate).
2021-05-10 16:58:48.745 +0800 Error:  EapolStatusCb(pan_auth_eapol.c:998): (AId:6751996388145100014) Certificate error (unknown CA).
2021-05-10 16:58:48.745 +0800 debug: mark_success(pan_auth_eapol.c:334): (AID:6751996388145100014) failed

• PAN-OS
• GlobalProtect Clientless VPN
• Authentication via Extensible Authentication Protocol (EAP) for RADIUS
• Windows Server 2008

Installing Certificate for (EAP) Extensible Authentication Protocol on Radius server

1. Get the Radius server certificate either from the third party certificate authority or generate the server certificate from the firewall.
2. Install the certificate with the private key in personal certificate store local to the windows machine.
3. Type administrative tool and open it
4. Open Network policy server,

5. Click on Network Policies and select the policy created for user authenticate for palo alto firewall. Example

6. Right click on properties, in the below example right click on palo and click on properties
7. Click on Constraints->Authentication Methods

8. Edit the Microsoft: Protected EAP( PEAP)
9. Select the correct server certificate which this radius server should present when any device tries to access this radius server.

10. Click OK