topic Re: Global Protect DUO users receiving two push notifications in GlobalProtect Discussions

Global Protect DUO users receiving two push notifications

Robert_Poplutz — Tue, 07 May 2024 14:11:02 GMT

Hi, i wonder if anyone can help! We have a customer who reported that ever since they have upgraded the firewalls to 10.1.12 a few weeks ago, users are receiving two DUO push notifications. The config was set with Authentication Override on the Portal (Generate cookie for authentication override - checked, Accept cookie for authentication override - checked) and everything worked for fine for years.

Global Protect client on version 6.0.7

The tunnel type is IPSEC

The timeouts are configured as described in this link:

>> https://help.duo.com/s/article/2054?language=en_US

The config was altered last week as described in this link:

>> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boODCAY

However, before this I had the Portal and Gateway config set up as in the screenshots, with the override cookie for the Portal, and no override for the Gateway. This way they would only receive a single 2FA request for the gateway.

A few weeks after upgrading this firewall, the customer also upgraded their other firewall at their other site to the same PAN-OS. After this upgrade, users connecting to this firewall also started to receive multiple prompts.

As far as I can tell, there is no known or addressed issue or article for this issue in Knowledge Base.

Thank you for coming up with some ideas.

Re: Global Protect DUO users receiving two push notifications

Raido_Rattameister — Tue, 07 May 2024 14:42:44 GMT

Generally portal needs to generate cookie and gateway needs to accept cookie (unless you want everyone with credentials to get access to portal and be able to establish VPN only after 2FA while connecting to gateway).

From your explanation it seems that you are missing override on the gateway "with the override cookie for the Portal, and no override for the Gateway".

Under "Monitor > Logs > GlobalProtect" look at "AUTH METHOD" and "ERROR" columns for "portal-auth" and "gateway-auth" events.

Do you see Cookie being used for gateway?

Re: Global Protect DUO users receiving two push notifications

Robert_Poplutz — Tue, 07 May 2024 16:12:51 GMT

We believe it's been configured correctly now (as per How to have only one push prompt in Global Protect DUO MFA with... - Knowledge Base - Palo Alto Networks) - see screenshots - can you comment please?

Cookie has not been used since April 30 - when customer altered the config as shown above. Customer has increased the timeout, but even when he was getting people to test within this 24hr timeframe, they were still getting two notifications.

Re: Global Protect DUO users receiving two push notifications

Raido_Rattameister — Tue, 07 May 2024 16:37:05 GMT

image007 shows "accept cookie" setting in gateway config unchecked.

image002_2 on the other hand shows it checked.

So which config is it?

Re: Global Protect DUO users receiving two push notifications

Robert_Poplutz — Thu, 09 May 2024 08:16:26 GMT

image002_2 shows the portal config - should this be amended?

Re: Global Protect DUO users receiving two push notifications

Christina_Sims — Thu, 09 May 2024 17:32:51 GMT

We had a ticket open for a similar issue. This was their response...

The issue has been reported internally and this is Fixed in 10.1.14, 10.1.13-h1, Currently, 10.1.13-h1 is released.

The Portal generates a cookie and the Gateway accepts the cookie No cookie is sent back to the client in the portal get config although the cookie generation GP log is generated.

Re: Global Protect DUO users receiving two push notifications

Robert_Poplutz — Fri, 10 May 2024 11:37:59 GMT

Thank you all for your contribution. Our customer will do a PAN-OS upgrade to 10.1.13-h1 as soon as it becomes the Preferred version. Currently 10.1.13-h1 status is "New".

Re: Global Protect DUO users receiving two push notifications

JFonner — Mon, 09 Sep 2024 17:50:38 GMT

Do you have a bug number for this? Having a similar issue on 11.1 version of software.

Re: Global Protect DUO users receiving two push notifications

FGauye — Wed, 05 Feb 2025 10:38:47 GMT

Hi,

Does anyone has news about this bug ?
I have the same issue with 11.1.5 version of software