Always on and user MFA

C.Meisch — Tue, 18 Aug 2026 22:09:28 GMT

Trying to configure Global Protect on new firewalls and update the MFA

Current configuration:
Clients configured w/always connected. Portal is configured w/pre-login device certificates from internal PKI. GW is configured w/LDAP and RADUIS. When a user tunnel is established, user must push yubikey to complete the config.

New Configuration:

We are trying to eliminate the 3rd party RADIUS provider but still have the Yubikey functionality.

In addition, I have configured Entra ID SSO and plan to use that going forward. What is the preferred way to enable the Yubikey? Do I need to configure a different RADIUS provider?

Lastly, when I go to the portal web page, I am prompted to need a valid certificate (see above). Will I need to import the local machine certificate into the browser for that to work or can I configure the portal differently?

TIA

topic Always on and user MFA in GlobalProtect Discussions

Always on and user MFA