article Nominated Discussion: Generate Cookie vs Accept Cookie in General Articles

article Nominated Discussion: Generate Cookie vs Accept Cookie in General Articles https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-generate-cookie-vs-accept-cookie/ta-p/538643 <DIV class="lia-message-template-content-zone"> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Nominated discussion_Generate cookie vs Accept cookie.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/49457i9E531E236A10A531/image-size/large?v=v2&px=999" role="button" title="Nominated discussion_Generate cookie vs Accept cookie.jpg" alt="Nominated discussion_Generate cookie vs Accept cookie.jpg" /></span></P> <P> </P> <P><SPAN>This Nominated Discussion Article is based on the post "</SPAN><A href="https://live.paloaltonetworks.com/t5/general-topics/generate-cookie-vs-accept-cookie/m-p/537763" target="_blank" rel="noopener">Generate cookie vs Accept Cookie</A><SPAN>" by <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/204018">@Schneur_Feldman</a> </SPAN><SPAN>and responded to by <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/15603">@Raido_Rattameister</a> .</SPAN><SPAN> Read on to see the discussion and solution!</SPAN></P> <P> </P> <BLOCKQUOTE> <P>Hi Team,</P> <P> </P> <P>Can anyone explain what Generate cookie and Accept cookie actually do? I always find myself messing with the cookie settings when enabling DUO/Azure SAML MFA but confused as to what the difference is and what they do.</P> <P> </P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Schneur_Feldman_0-1680710262228.png" style="width: 400px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/49285i5BA0286D1108A2CF/image-size/medium/is-moderation-mode/true?v=v2&px=400" role="button" title="Schneur_Feldman_0-1680710262228.png" alt="Schneur_Feldman_0-1680710262228.png" /></span></P> <P> </P> </BLOCKQUOTE> <P><STRONG>Response:</STRONG> </P> <P> </P> <BLOCKQUOTE> <P>GP Agent first connects to portal to pull down list of gateways.</P> <P>Then it will connect to one of gateways (either based on priority or latency but this is different topic).</P> <P>GP Agent will cache list of gateways. By default for 24 hours.</P> <P> </P> <P>So every 24 hours GP Agent needs to connect to Portal to check if config has changed.</P> <P> </P> <P>This causes user to accept DUO push for portal login and then right after second time for gateway login.</P> <P> </P> <P>To overcome this you can configure portal to generate cookie and gateway to accept cookie with 1 minute timeout.</P> <P>This means that if config has timed out in GP Agent and it connects to portal first portal will generate cookie and during second auth to gateway this cookie is used to authenticate instead of full SAML MFA.</P> <P> </P> <P>If 1 minute passes, user disconnects and connect again then gateway don't accept any more this old cookie and SAML will be used with full blown 2FA auth.</P> </BLOCKQUOTE> <P> </P> </DIV> Mon, 17 Apr 2023 16:38:45 GMT JayGolf 2023-04-17T16:38:45Z Nominated Discussion: Generate Cookie vs Accept Cookie https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-generate-cookie-vs-accept-cookie/ta-p/538643 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Nominated discussion_Generate cookie vs Accept cookie.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/49458iB736CBE948AF7C23/image-size/large?v=v2&px=999" role="button" title="Nominated discussion_Generate cookie vs Accept cookie.jpg" alt="Nominated discussion_Generate cookie vs Accept cookie.jpg" /></span></P> <P> </P> <P><SPAN>This Nominated Discussion Article is based on the post "</SPAN><A href="https://live.paloaltonetworks.com/t5/general-topics/generate-cookie-vs-accept-cookie/m-p/537763" target="_blank" rel="noopener">Generate cookie vs Accept Cookie</A><SPAN>".</SPAN></P> Mon, 17 Apr 2023 16:38:45 GMT https://live.paloaltonetworks.com/t5/general-articles/nominated-discussion-generate-cookie-vs-accept-cookie/ta-p/538643 JayGolf 2023-04-17T16:38:45Z