Hardware reference guide

GlobalProtect Administrator’s Guide 17
Set Up the GlobalProtect Infrastructure Set Up GlobalProtect User Authentication
How Does the Agent Know What Credentials to Supply to the Portal and Gateway?
By default, the GlobalProtect agent attempts to use the same login credentials for the gateway that it used for
portal login. In the simplest case, where the gateway and the portal use the same authentication profile and/or
certificate profile, the agent will connect to the gateway transparently. However, if the portal and the gateway
require different credentials (such as unique OTPs), this default behavior would cause delays in connecting to
the gateway because the gateway would not prompt the user to authenticate until after it tried and failed to
authenticate using the portal credentials the agent supplied.
There are two options for modifying the default agent authentication behavior on a per-client configuration
basis:
 Cookie authentication on the portal—The agent uses an encrypted cookie to authenticate to the portal
when refreshing a configuration that has already been cached (the user will always be required to authenticate
for the initial configuration download and upon cookie expiration). This simplifies the authentication
process for end users because they will no longer be required to log in to both the portal and the gateway in
succession or enter multiple OTPs for authenticating to each. In addition, this enables use of a temporary
password to re-enable VPN access after password expiration.
 Disable forwarding of credentials to some or all gateways—The agent will not attempt to use its portal
credentials for gateway login, enabling the gateway to immediately prompt for its own set of credentials. This
option speeds up the authentication process when the portal and the gateway require different credentials
(either different OTPs or different login credentials entirely). Or, you can choose to use a different password
on manual gateways only. With this option, the agent will forward credentials to automatic gateways but not
to manual gateways, allowing you to have the same security on your portals and automatic gateways, while
requiring a second factor OTP or a different password for access to those gateways that provide access to
your most sensitive resources.
For an example of how to use these options, see Enable Two-Factor Authentication Using One-Time Passwords
(OTPs).
Two-factor authentication
You can enable two-factor authentication by configuring both a certificate profile and an
authentication profile and adding them both to the portal and/or gateway configuration.
Keep in mind that with two-factor authentication, the client must successfully authenticate
via both mechanisms in order to gain access to the system.
In addition, if the certificate profile specifies a Username Field from which to obtain the
username from the certificate, the username will automatically be used for authenticating to
the external authentication service specified in the authentication profile. For example, if the
Username Field in the certificate profile is set to Subject, the value in the common-name field
of the certificate will by default be used as the username when the user attempts to
authenticate to the authentication server. If you do not want to force users to authenticate
with a username from the certificate, make sure the certificate profile is set to None for the
Username Field. See Remote Access VPN with Two-Factor Authentication for an example
configuration.
Authentication Method Description