topic Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents in General Topics

End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

HarryScore — Thu, 12 Sep 2024 02:54:24 GMT

I need some advices on this GP VPN Client with MFA issue:

End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

The current auth environment is that users use Active Directory in Azure for MFA and use Radius to authentication process in Globalprotect.

Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

JayGolf — Mon, 16 Sep 2024 22:17:53 GMT

Hi @HarryScore ,

How long do you have timeout setup for RADIUS?

Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

HarryScore — Tue, 17 Sep 2024 02:52:28 GMT

@JayGolf current Radius timeout setup is 30 secs

is there a way to check GP timeout setting?

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBufCAG&lang=en_US%E2%80%A9

Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

kiwi — Tue, 17 Sep 2024 10:37:38 GMT

Hi @HarryScore ,

Source: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBufCAG&lang=en_US%E2%80%A9

>configure
# set deviceconfig setting global-protect timeout 90
#commit

# show deviceconfig setting global-protect
global-protect {
  timeout 90;
}
# exit

Hope this helps,

Kim.

Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

Brandon_Wertz — Tue, 17 Sep 2024 15:22:10 GMT

@HarryScore wrote:

I need some advices on this GP VPN Client with MFA issue:

End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

The current auth environment is that users use Active Directory in Azure for MFA and use Radius to authentication process in Globalprotect.

This isn't exactly your question, but can you do MFA from Azure? If you tie the MFA from Azure it's an easier way to enforce the MFA process from an Azure authentication, vice letting the downstream system enforce it. Also doing it at the Azure level ensure you have a consistent MFA process.

Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

JayGolf — Tue, 17 Sep 2024 18:36:02 GMT

@HarryScore ,

Try setting the timeout to at double of what you set up in Radius. If that doesn't work, I'd try increasing your radius to 60 sec.

Re: End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

HarryScore — Thu, 19 Sep 2024 02:53:01 GMT

Thanks everyone.

beside the radius server, we have another NPS server with NPS Extension for Azure MFA.

I have tried to setup the GP timeout to 90 secs, Radius server to 60 secs, still no luck. Palo TAC doesn't help much either.

We are deploying Prisma now which should be resolve the issue.