topic Re: Allow single user to bypass MFA in General Topics

Allow single user to bypass MFA

isentric89 — Thu, 10 Feb 2022 23:14:43 GMT

Hi All,

I would like to access Global Protect for myself using different profile to access one of our resources subnet 10.21.xx.xx.

I want to access without having to go through 2FA. Any idea for it? is it possible?

Do we need to create another gateway on the GP for a single user?

Re: Allow single user to bypass MFA

TomYoung — Wed, 16 Feb 2022 16:51:13 GMT

Hi @isentric89 ,

Yes, you can have different authentication methods for different users.

Create a new authentication profile without MFA and list only yourself under Advanced > Allow List.
Add a new Authentication Sequence, with your new authentication profile on top.
Change you authentication profile under both the portal and gateway to the authentication sequence.
Since you are the only one in the allow list, the new authentication profile will be used for you. The existing one will be used for everyone else.

You do not need a new gateway. With regard to access to resources, that is controlled in the security policy.

Thanks,

Tom

Edit: Thank you @aleksandar.astardzhiev for the feedback! I actually made this same mistake when doing this for a customer months ago, and forgot my lesson learned! I have corrected my steps above.

Re: Allow single user to bypass MFA

aleksandar.astardzhiev — Wed, 16 Feb 2022 07:39:35 GMT

Hey @TomYoung ,

Will the GP falback to the second authentication schema, if the first one reject the the user?

I have used two authentication schema only for two different types of OS, so I got the impresion that GP will select auth schema based on the OS, top-to-bottom, but it reject the authentication it will not falback to the rest in the list.

I was thinking more like using authentication sequence

- Create auth sequenece and put the authentication profile without MFA first and second the auth profile with MFA

- Non-MFA profile can be configured with allow list as you suggested

- Use the Authentication Sequence as authentication schema for GlobalPortect Portal and Gateway authentication.