topic Re: Configure TOTP (Google Authenticator) for GlobalProtect in GlobalProtect Discussions

Configure TOTP (Google Authenticator) for GlobalProtect

royolsen — Thu, 16 Apr 2020 12:00:41 GMT

I have looked at the different support documents and previous discussions but have not gotten much wiser.

I need to have a handful of users connect to GlobalProtect with TOTP as the second authentication factor. Since the number of users are so low, they can either live on our LDAP service (preferred) or as local users. The TOTP is to be verified by existing RADIUS.

On existing solutions, such as Cisco ASA (AnyConnect), the authentication flow is as follows for on demand VPN:

a) user provides username, password and one time password on login screen

b) username and password is used to authenticate against LDAP

c) username and one time password is sent to RADIUS for match against the TOTP backend

d) user is logged in

On PaloAlto I would perhaps expect the flow to be something like:

a) user provides username and password to GP portal

b) username and password is authenticated against LDAP (or local user database)

c) gp portal checks for valid authentication cookie, if valid go last step

d) ask user for one time password

e) username and one time password is sent to RADIUS for match again TOTP backend

f) set authentication cookie

g) authentication override allows user to connect to GP gateway using authentication cookie

Is it possible to set up something like this, or do we need to build a completely different RADIUS TOTP setup just for GP?

Re: Configure TOTP (Google Authenticator) for GlobalProtect

pm08yx — Wed, 17 Jun 2020 15:32:19 GMT

I would love an answer to this as well!

Re: Configure TOTP (Google Authenticator) for GlobalProtect

doug-elliott — Wed, 19 Aug 2020 13:02:10 GMT

Same here minus the RADIUS server. If I avoid using two-factor authentication with GlobalProtect to authenticate to the gateway or portal, it should be possible to use GlobalProtect to notify the user about an authentication policy match (UDP message), a Multi Factor Authentication server profile would be sufficient, yes? Specifically, I would like to know how this would work with Google Authenticator.

Re: Configure TOTP (Google Authenticator) for GlobalProtect

doug-elliott — Wed, 19 Aug 2020 14:12:20 GMT

UPDATE: TAC response.

For remote user authentication to GlobalProtect portals and gateways, the firewall integrates with MFA vendors using RADIUS and SAML only. As of now, The Google authenticator app is not supported by Palo Alto for multi-factor authentication. Supported MFA vendors are Okta, PingID, RSA token, DUO. Below document explains about the Multi Factor authentication in detail.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CmSm

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication

Re: Configure TOTP (Google Authenticator) for GlobalProtect

SteveO808 — Wed, 30 Aug 2023 19:25:44 GMT

Both of those links are broken, are there updated ones?

Re: Configure TOTP (Google Authenticator) for GlobalProtect

EStangeland — Fri, 06 Oct 2023 13:13:58 GMT

Now 3 years has passed. Any updates here? Those two links still seem broken.

Re: Configure TOTP (Google Authenticator) for GlobalProtect

kiwi — Mon, 09 Oct 2023 12:30:07 GMT

Hi @EStangeland ,

Here's the compatibility matrix for MFA vendor support:

https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table#id17CBB0W095Z

Here are some updated links to replace the old ones:
https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/authentication-types/multi-factor-authentication

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-user-authentication/configure-globalprotect-to-facilitate-multi-factor-authentication-notifications

Kind regards,

-Kim.

Re: Configure TOTP (Google Authenticator) for GlobalProtect

TomYoung — Mon, 09 Oct 2023 15:22:45 GMT

Hi everyone,

For those organizations that need to configure GlobalProtect with Google Authenticator, there are a couple of options.

Configure a RADIUS server that handles both the primary and MFA authentication. Here is one that uses AD and Google Authenticator. https://kb.hillstonenet.com/en/wp-content/uploads/2019/09/SSLVPN-Two-factor-Authentication-with-Google-Authenticator.pdf
If you have Google Workspace accounts, you can enable MFA on it and connect to it with SAML. https://www.youtube.com/watch?v=BANa4rFh1Ck https://www.bitbodyguard.com/articles/palo-alto-networks/google-cloud-identity-as-saml-idp/

I have not configured Google MFA, but I have done these solutions with other products. I found the links through Google.

Thanks,

Tom

Re: Configure TOTP (Google Authenticator) for GlobalProtect

EStangeland — Wed, 11 Oct 2023 11:49:45 GMT

I tried SAML against Microsoft 365 in lab. It works.

But if you need multi tenant, and at same time avoid having to create one GP gateway per tenant, you still have a problem.

I did some experiments using https://login.microsoftonline.com/common/saml2 - but still without finding a working setup for multi tenant.

Re: Configure TOTP (Google Authenticator) for GlobalProtect

JoseJarrin — Thu, 14 Mar 2024 22:42:06 GMT

Hello
I have in my infrastructure a double authentication factor for global protect users.
For them I used Cisco Duo, the connection and integration is really easy.
With this I can control the double factor through an external RAdius server.

Re: Configure TOTP (Google Authenticator) for GlobalProtect

Joerg_Mayer — Sun, 17 Mar 2024 21:02:36 GMT

I have a mostly working PoC with RADIUS: freeradius 3.2 (3.0 also works) on Linux with google-authenticator via PAM that uses non-Linux-Users in a centralized directory.

- Stuff that works: 2FA as such via RADIUS

+ Login with username and password against AD LDAPS

+ Separate Challenge Screen afterwards for google-authenticator

- Stuff that needs to work before the PoC is acceptable for production:

+ How do I get the LDAP groups for UserID with RADIUS-Authentication? [not yet researched]

+ Validate that Users are members of the Global-Protect-VPN-Group in LDAP, fail authentication otherwise - without hardcoding the LDAP group check in the RADIUS configuration [not yet researched. Workaround: Hardcode in the RADIUS config file]

+ How do I manage to run the RADIUS-Service as HA (google-authenticator uses one file per user that contains state, i.e. they are written to with each attempted access). No DB support. [Untested solution idea]

+ How do I implement this with EAP-GTC on freeradius/PA? [current implementation is using PAP and as PA does not support RADSEC, I need something that satisfies BSI (Germany) security requirements - which classical RADIUS PAP security doesn't.]

And before anyone asks: Once this works I'll post a solution here for review/feedback/possible improvements 🙂

Re: Configure TOTP (Google Authenticator) for GlobalProtect

mirzaalora — Mon, 18 Mar 2024 04:53:33 GMT

Hi, I have two authentication factors for global Purva Tranquillity protect users in my infrastructure.