How to configure Global Protect for certificate-based HIP match

• GlobalProtect
• Prisma Access
• Existing PKI  

1. Navigate to Device > Certificates and import the CA certificate

2. Navigate to Device> Certificate Profile and configure certificate profile

3. Navigate to Portal > Agent > (Config-name) > HIP data collection and use the certificate profile configured in step 2 for HIP processing ​​​​​

4. Navigate to Objects > HIP Objects and configure the HIP object with match criteria. 
   NOTE: Do note the format in which the value is configured. The value has to match the subject in the Certificate information. Here it is /DC=local/DC=su-lab/CN=SU-LAB-CA

5. Import the client certificate on the user's machine in the local machine store. The certificate should be installed with the KEY.

 

6. Navigate to the Global Protect App Host information tab for validation

For best practices regarding certificate configuration for GlobalProtect, please refer to the following document:

•  GlobalProtect Certificate Best Practices