topic Re: Authentication Sequence problem in Next-Generation Firewall Discussions

Authentication Sequence problem

boblin — Thu, 11 May 2023 01:29:12 GMT

I configured DUO Proxy for GloablProtect MFA redundancy on our PA 850 firewall using Authentication Sequence. This post shows how I configured: Configure two duo proxy servers for Palo alto firewall MFA redundancy – Net/PC How to (howtonetworking.com)

The problem I have is when the top Authentication profile or DUO Proxy server is down, then the user can't login to GloablProtect. The DUO Proxy server and PA authentication profile is not the issue because I can run the test command successfully.

test authentication authentication-profile <authentication-profile-name> username <username> password

Alos, if I move the second profile (DUO Authentication-2 in my example) to the top, it works.

The problem is if the top authentication DUO proxy server (DUO Authentication-2) is down, no one can't login. MONITOR>Logs>System doesn't have authentication information. If I move the second authentication profile (DUO Authentication in my example) to the top, then it works again. I think it is Authentication Sequence problem but can't figure out how to fix it.

Re: Authentication Sequence problem

BPry — Thu, 11 May 2023 19:00:44 GMT

@boblin,

That guide doesn't have you modifying the authentication timeout value which will cause this behavior. By default GlobalProtect's timeout is 30 seconds, you'll need to adjust things a bit to account for the delay being introduced by the authentication sequence and the down host.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBufCAG&lang=en_US%E2%80%A9

Re: Authentication Sequence problem

boblin — Thu, 11 May 2023 21:25:10 GMT

I fixed the problem by adjusting the timeout. Thank you!