GP MFA Authentication Notifications Non-browser-based applications

WMarburger — Mon, 31 Jul 2023 10:32:32 GMT

Hi,

I try to configure a MFA notification, so the GP app will trigger a pop up message to authenticate with a radius server.

Here the config guide:

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/configure-globalprotect-to-facilitate-multi-factor-authentication-notifications

The authentication rule gets hits, but the message / captive portal is not showing up, when the user tries to access a non-http service (rdp,ssh). Also the traffic is allowed by the security rule, but the server is not accessible.

In the description is written:

"If you are using GlobalProtect to notify the user about an authentication policy match (UDP message), a Multi Factor Authentication server profile is sufficient."

So is a MFA server profile mandatory (with global protect), or can a radius server profile be used instead?

If a radius server profile can be used, what needs to be configured instead of the MFA (in the auth. profile, or GP agent)?

topic GP MFA Authentication Notifications Non-browser-based applications in GlobalProtect Discussions

GP MFA Authentication Notifications Non-browser-based applications