topic Re: DUO MFA popup twice for approval login GloablProtect in Next-Generation Firewall Discussions

DUO MFA popup twice for approval login GloablProtect

boblin — Thu, 11 May 2023 01:48:20 GMT

We configured PA 850 firewall to use DUO for GloablProtect MFA. It works. However, we have an issue. In GloablProtect Gateway Configuration>Agent>Client Settings, if I add a user, for example blin. it works fine. If I add a AD OU, for example Employees, the login user will get two DUO aoorval popup twice.

From the DUO Authentication, I can see two Granted.

Why it works if I add a user manually one by one, but it popup for two MFA approvals if I add the group or UO to the Gateways?

Re: DUO MFA popup twice for approval login GloablProtect

BPry — Thu, 11 May 2023 18:54:37 GMT

@boblin,

Do you have DUO configured on both the Portal and the Gateway, or just the gateway? If you have it on both, are you using authentication cookies at all to avoid the double prompt?

Re: DUO MFA popup twice for approval login GloablProtect

boblin — Thu, 11 May 2023 19:38:02 GMT

I have just one DUO authentication for both. Where to configure authentication cookies?

Re: DUO MFA popup twice for approval login GloablProtect

boblin — Thu, 11 May 2023 20:31:08 GMT

I have both Generate cookie for authentication override and Accept cookie for authentication override checked. Is this you talking about?

Re: DUO MFA popup twice for approval login GloablProtect

boblin — Sat, 13 May 2023 00:17:22 GMT

This is how I fix the problem step by step with screenshots:

DUO MFA popup twice for approval login GloablProtect