topic Re: Does PAN-OS VPN functionality support MFA? in General Topics

Does PAN-OS VPN functionality support MFA?

packetfarmer — Tue, 26 Apr 2022 13:49:17 GMT

Hey guys,

I'm looking at moving off Sonicwall NSA 3600 and onto a PAN appliance. One factor is that I'm currently using Sonicwall's VPN functionality which has some simple, built-in MFA in the form of TOPT codes that the user must put in each time they connect to the VPN. Its not dependent on any other service so its kind of nice that way. I was just wondering what PAN has in the form of MFA on VPN?

Re: Does PAN-OS VPN functionality support MFA?

LAYER_8 — Tue, 26 Apr 2022 17:11:44 GMT

Isn't built in, integrates with anything that speaks SAML. Note, we can do this over VPN but also within the confines of your enterprise network/office as well for users accessing sensitive subnets/applications.

See more here.

Re: Does PAN-OS VPN functionality support MFA?

packetfarmer — Tue, 26 Apr 2022 18:13:22 GMT

hmm, cool. So I could integrate PAN with MS Azure MFA and use that?

Re: Does PAN-OS VPN functionality support MFA?

BPry — Tue, 26 Apr 2022 22:57:52 GMT

@packetfarmer,

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/palo-alto-networks-globalprotect-tutorial

Re: Does PAN-OS VPN functionality support MFA?

Adrian_Jensen — Tue, 26 Apr 2022 23:16:48 GMT

Yeah, the PA has a few built in MFA vendor connectors: DUO, Okta, PingID, and RSA SecureID. Additionally you can use a user/pass auth connection to an authentication server that issues MFA itself, via: Radius, TACACS, LDAP, Kerberos, or SAML.

In our case the PA does a Radius auth request to an inhouse DUO server, which authenticates user/pass against our AD and then sends the MFA code through a third party server. When the MFA succeeds the Radius returns a permit response. We are going to be moving to an Azure MFA and, although it isn't setup yet, I believe it will just be changing the auth profile to use a SAML connection and cert to Azure and receiving back the permit/deny response.

Re: Does PAN-OS VPN functionality support MFA?

packetfarmer — Wed, 27 Apr 2022 00:39:10 GMT

Awesome, thanks all!