topic VPN SSO with MFA every time in GlobalProtect Discussions

VPN SSO with MFA every time

edmozley — Mon, 21 Nov 2022 15:41:25 GMT

We have recently purchased a Palo Alto firewall and connect to the VPN using GlobalProtect.

For Teams/Sharepoint etc. We use Azure MFA where a push notification comes through to the authenticator app and to get this working on GlobalProtect we had to set up a radius server.

The reason we can't use Azure MFA with GlobalProtect is that we want someone to be prompted for MFA every time they connect to the VPN. This works with radius but with Azure MFA you only get prompted once per hour.

The problem we have is that now we can't use single sign on for Global Protect as this doesn't work with Radius.

Is there any way around this - so we can have single sign on and be prompted for MFA on the microsoft authenticator app every time?

Thanks!

Re: VPN SSO with MFA every time

aleksandar.astardzhiev — Sun, 27 Nov 2022 17:07:24 GMT

Hi @edmozley,

I am not sure if I understand your question, so let me know if I got it wrong.

If you want GlobalProtect to prompt user only once every hour, the simple way is to use Cookie Authentication on the Portal or Gateway (paloaltonetworks.com)

Basically when user have authenticated successfully, FW will generate a cookie which will be sent to the GP client (you can configure the lifetime duration of the cookie, aka how long after its creations is considered valid). Upon next connection GP client will first send it cookie (if such exist on the machine), FW will check its validity and if it valid will authenticate the user without prompting the user for credentials.

Re: VPN SSO with MFA every time

cdamore — Thu, 11 Apr 2024 20:17:20 GMT

Hello, where you able to find a way to prompt a user for MFA each time they sign on using Microsoft Authentication and SAML?