How to check HIP certificate information on GlobalProtect app and firewall

This article explains how HIP certificate check works using Self Signed CA certificate.

• Palo Alto Firewalls
• Supported PAN-OS versions
• Supported GlobalProtect (GP) App versions
• GlobalProtect Portal with "Certificate Profile for HIP Processing" enabled
• HIP object/profile with HIP Certificate check enabled

1. Self-Signed CA certificate and machine certificate can deployed using this article.
   • Machine certificate was created with Subject/Common Name (CN) as windows.machine
   • Exported this certificate as Encrypted Private Key and Certificate (PKCS12)

2. Configure GlobalProtect using this article. 
    
3. Configure Certificate Profile "TGP" and reference it under HIP Data Collection:

GUI: Network > GlobalProtect > Portals > [portal name] > Agent > Configs > Hip Data Collection > Certificate Profile for HIP processing 

4. Imported the Machine certificate under Personal folder of Local Computer:
    
5. Configure the HIP object with Certificate check enabled and reference the Certificate Profile "TGP":
   
6. Once the user successfully connects to GlobalProtect, certificate information can be viewed on firewall and GP app: 
   • GUI: Monitor > Logs > HIP Match

• • Host Information Profile on GP app