topic Re: With PanOs and DUO (As 2FA), Entering on Windows Globalprotect ask to duo indefinitely. in General Topics

With PanOs and DUO (As 2FA), Entering on Windows Globalprotect ask to duo indefinitely.

jlmudarra — Wed, 10 Aug 2022 13:37:47 GMT

Hello Everybody,

We have recently upgraded our Firewalls to PanOs 10.2.2. We have DUO as a second factor authentication.

The config we have is with "Always On" , from the upgrade, When a Computer starts, the user enter the credentials, and then Globalprotect try to connect to the VPN (Single Sign on active). The trouble arrives if the user forget to answer the second factor popup (because the computer is inside our lan, p.Ex.), Globalprotect retries indefinitely and DUO blocks the user.

We doesn't have any problem like this in the past.

We had some changes without success, Any help on that?

Regards

Re: With PanOs and DUO (As 2FA), Entering on Windows Globalprotect ask to duo indefinitely.

JayGolf — Fri, 12 Aug 2022 05:15:41 GMT

Hi @jlmudarra , if the user answers the 2nd factor prompt are they able to login successfully?

Re: With PanOs and DUO (As 2FA), Entering on Windows Globalprotect ask to duo indefinitely.

jlmudarra — Fri, 12 Aug 2022 13:39:36 GMT

Yes, Always. In just in this PanOs version 10.2.2 that we're experiencing this trouble. The users allways receive the DUO 2FA petition... Is they accepts all OK, if the user don't do anything Globalprotect continues sending more petitions and DUO blocks at 10 attemps.

Regards

Re: With PanOs and DUO (As 2FA), Entering on Windows Globalprotect ask to duo indefinitely.

S.Cantwell — Mon, 15 Aug 2022 15:36:48 GMT

I always recommend that you enable 2FA/MFA ONLY on the gateway side and not on the portal side of the FW.
This way, they are only needing to answer the MFA 1x and not 2 times.

Re: With PanOs and DUO (As 2FA), Entering on Windows Globalprotect ask to duo indefinitely.

jlmudarra — Tue, 16 Aug 2022 05:55:17 GMT

Yes, this is not the problem. With our old PanOS version 10.1.4 was working fine, now with the 10.2.2 not. A lot of petitions if the user are not waiting and not accepting the 2FA ticket.