topic Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect in Next-Generation Firewall Discussions

Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

hamza_d — Sat, 01 Jun 2024 21:09:00 GMT

Hello,

I need to integrate my FortiAuthenticator, which is located at a remote site, with my PA firewall to add additional authentication factors for users connecting to GlobalProtect.

I haven't been able to find the documentation and procedures to accomplish this. I would appreciate it if someone with experience in this could provide the necessary requirements and configuration steps.

Thank you in advance.

Re: Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

aleksandar.astardzhiev — Mon, 03 Jun 2024 09:09:46 GMT

Hi @hamza_d ,

I am guessing you are talking about the "native MFA" functionallity described here - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/configure-multi-factor-authentication

There you can see that this can be only used with handful of third party IdPs like PingID, Okta, Duo - https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support

However as any other firewall vendor you can enable MFA using any of the other standard authentication methods - RADIUS, TACACS, SAML.

You can find instructions how to configure any of these auth. protocols in the first link above. The next step is to enable the MFA, but this is all done on the FortiAuthenticator.

Re: Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

hamza_d — Mon, 03 Jun 2024 23:30:08 GMT

Thanks, @aleksandar.astardzhiev,

Could you clarify what you mean by "native MFA"? Based on your experience, which is recommended: using FortiAuthenticator as a RADIUS server or as an IdP server (SAML)?

Re: Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

hamza_d — Wed, 05 Jun 2024 22:41:42 GMT

Hi @aleksandar.astardzhiev ,

I am waiting for your response.

Thank you.

Re: Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

OllyBe — Thu, 06 Jun 2024 13:48:54 GMT

@aleksandar.astardzhiev wrote:

Hi @hamza_d ,

I am guessing you are talking about the "native MFA" functionallity described here - https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/configure-multi-factor-authentication

There you can see that this can be only used with handful of third party IdPs like PingID, Okta, Duo - https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support

However as any other firewall vendor you can enable MFA using any of the other standard authentication methods - RADIUS, TACACS, SAML.

You can find instructions how to configure any of these auth. protocols in the first link above. The next step is to enable the MFA, but this is all done on the FortiAuthenticator.

Native MFA means native multi factor authentication

Re: Integrating FortiAuthenticator with PA Firewall for Multi-Factor Authentication on GlobalProtect

aleksandar.astardzhiev — Thu, 06 Jun 2024 14:34:39 GMT

Hi @hamza_d ,

Q: Could you clarify what you mean by "native MFA"?

A: Please check the link I provided earlier. I have never had an use case to use this, but my understanding is that FW is communicating with some kind of API with one of those IdP services (Okta, Duo etc) instead of the using additional auth protocol

Q: Based on your experience, which is recommended: using FortiAuthenticator

A: I would say this is heavilty depends on your requirements, environment and setup. Lately more people are prefering SAML mainly because it could provide great Single Sign-On experience for the end users. Also with RADIUS I am not sure you can have "push notification" for MFA, user will need to manually type the one-time-password. While with SAML you can have push notifcation, allowing the user just to click "approve" button