Hardware reference guide

16 GlobalProtect Administrator’s Guide
Set Up GlobalProtect User Authentication Set Up the GlobalProtect Infrastructure
Supported GlobalProtect Authentication Methods
Authentication Method Description
Local Authentication
Both the user account credentials and the authentication mechanisms are local to the firewall.
This authentication mechanism is not scalable because it requires an account for every
GlobalProtect end user and is therefore only recommended in very small deployments.
External authentication
The user authentication functions are offloaded to an existing LDAP, Kerberos, or RADIUS
service (including support for two-factor token-based authentication mechanisms such as
one-time password (OTP) authentication). To enable external authentication, you must first
create a server profile that defines access settings for the external authentication service and
then create an authentication profile referencing the server profile. You then reference the
authentication profile in the portal, gateway, and/or Mobile Security Manager configurations.
You can use different authentication profiles for each GlobalProtect component. See Set Up
External Authentication for instructions on setting this up. See Remote Access VPN
(Authentication Profile) for an example configuration.
Client certificate
authentication
The portal or the gateway uses a client certificate to obtain the username and authenticate
the user before granting access to the system. With this type of authentication, you must issue
a client certificate to each end user; the certificates you issue must contain the username in
one of the certificate fields, such as the Subject Name field. If a certificate profile is
configured on the GlobalProtect portal, the client must present a certificate in order to
connect. This means that certificates must be pre-deployed to the end clients before their
initial portal connection.
In addition, the certificate profile specifies which certificate field to obtain the username
from. If the certificate profile specifies Subject in the Username Field, the certificate
presented by the client must contain a common-name in order to connect. If the certificate
profile specifies a Subject-Alt with an Email or Principal Name as the Username Field, the
certificate presented by the client must contain the corresponding fields, which will be used
as the username when the GlobalProtect agent authenticates to the portal or gateway.
GlobalProtect also supports common access card (CAC) and smart card-based
authentication, which rely on a certificate profile. In this case, the certificate profile must
contain the root CA certificate that issued the certificate in the smart card/CAC.
If you are using client certificate authentication, you should not configure a client certificate
in the portal configuration as the client system will provide it when the end user connects.
For an example of how to configure client certificate authentication, see Remote Access VPN
(Certificate Profile).