Global Protect MFA with Google Authenticator

SandipKumbhar — Fri, 14 Jul 2023 11:50:11 GMT

Dear Team,

Please help me understand can we configure TOTP Google Authenticator(Free) for Global Project VPN users

we have configured Global Protect VPN with AD authentication and want to configure the above solution.

Thanks in Advance

Regards

Sandip Kumbhar

Re: Global Protect MFA with Google Authenticator

TomYoung — Mon, 17 Jul 2023 01:49:16 GMT

Hi @SandipKumbhar ,

PAN-OS does not support Google MFA natively -> https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table#id17CBB0W095Z.

One solution that you can use is a RADIUS server that supports both LDAP and Google TOTP, e.g. https://sysopstechnix.com/enable-2fa-on-freeradius-with-openldap-users/. I just Googled that one. I have not used it.

On the NGFW, all you do is configure the RADIUS server for GlobalProtect. Check out the diagram in the 2nd URL. If you do not want users to get prompted twice for MFA (portal and gateway), you can (1) enable authentication cookies or (2) use RADIUS for the portal and LDAP for your gateway.

Thanks,

Tom

topic Re: Global Protect MFA with Google Authenticator in General Topics

Global Protect MFA with Google Authenticator

Re: Global Protect MFA with Google Authenticator