GlobalProtect Certificate Validation Failed: Root CA Not Imported
A company is deploying GlobalProtect for remote users and wants to enforce that only users with valid certificates are allowed to connect. Which configuration is required on the GlobalProtect gateway?
⚠ Common exam trap
Test-takers frequently confuse portal authentication settings with gateway authentication settings, assuming that configuring a certificate profile on the portal will automatically enforce certificate-based access on the gateway, but the gateway requires its own separate authentication configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a certificate profile in the gateway's authentication settings
A certificate profile must be configured in the gateway's authentication settings to enforce certificate-based authentication. This profile defines the trusted Certificate Authority (CA) and validation criteria (e.g., CRL checking, OCSP), ensuring only clients presenting a valid certificate issued by that CA can establish a GlobalProtect tunnel. Without this, the gateway would fall back to username/password or other configured authentication methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Define a tunnel interface with an IP address that matches the certificate subject
Why it's wrong here
A tunnel interface address has no bearing on certificate validation; the gateway needs a certificate profile bound to its authentication settings. It is tempting because tunnel interfaces are genuinely part of GlobalProtect gateway configuration, and defining one would be correct when configuring the tunnel for client traffic, not for enforcing certificate-based authentication.
- ✗
Set the gateway's IP pool to require certificate authentication
Why it's wrong here
The IP pool assigns tunnel addresses to connected clients and contains no authentication settings, so it cannot enforce certificate validation. It is tempting because the pool is a required gateway field, and configuring it would be correct when defining which addresses GlobalProtect clients receive after connecting.
- ✓
Configure a certificate profile in the gateway's authentication settings
Why this is correct
A certificate profile bound to the gateway's authentication settings makes the firewall validate the client certificate chain against the specified trusted CA, rejecting connections without a valid certificate. This enforces certificate-based authentication for GlobalProtect remote users.
- ✗
Configure client authentication in the portal with a certificate profile
Why it's wrong here
Client authentication belongs on the gateway, which terminates the tunnel and validates the client certificate; configuring it on the portal only governs portal login. It is tempting because portals and gateways share authentication settings, and a certificate profile on the portal would be correct if the requirement were to authenticate users before downloading the agent.
Go deeper
Related to this question
About these practice questions
This PCNSE question is part of Courseiva's 319-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSE practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSE exam.