In Day 45 of my PCNSA Palo Alto Firewall Training series, I show you how to configure GlobalProtect VPN authentication using a client certificate instead of the normal username/password method. In my previous video I used local authentication (I created the user inside the Palo Alto firewall), but in this lab I switch the portal and gateway to certificate-based authentication—because most industries are moving towards certificate-only access. I start by creating a Certificate Profile (I name it GP profile) and I use the certificate subject as the username field, then I select the CA certificate that I already generated for GlobalProtect. After that, I go into the GlobalProtect Portal and Gateway settings and remove the old authentication profile (credential-based) and replace it with my certificate profile, then I commit the changes. On the client side, you’ll see the exact error you get when a valid certificate is missing, and then I generate a client certificate, export it in the correct format with a password, and import it into the client machine. Finally, I connect GlobalProtect again and you can see it connects without asking any username/password—authentication happens using the certificate. I also show you where to verify this in the firewall (Monitor > GlobalProtect and Gateway remote users) so you can validate it in your own lab and later apply the same concept in production.