topic Re: Two-factor PAN webconsole authentication in General Topics

Two-factor PAN webconsole authentication

Oasen — Fri, 03 Jul 2015 06:45:59 GMT

Hi,

I would like to use a two-factor authentication for the administrators when they access the PAN-500 web console.

With an authentication sequence I can use 2 ways to authenticate but I want to force the use of both. Is that possible?

Re: Two-factor PAN webconsole authentication

BLH — Fri, 03 Jul 2015 08:42:02 GMT

As far as I know, that would only be possible if combining a Certificate Profile with the Authentication Profile.

For proper 2FA, you should have a dedicated RADIUS 2FA server.

Re: Two-factor PAN webconsole authentication

Oasen — Fri, 03 Jul 2015 10:36:50 GMT

And with 'certificate profile' you mean the new function in 7.0 right?

Re: Two-factor PAN webconsole authentication

jwolach — Wed, 01 Jun 2016 19:58:22 GMT

Hello Oasen,

I'm currently running PAN-OS 7.1.2 on a PA-200 and recently added Two-factor Authentication for administrator account logins using the Duo Security 2FA system. Here's a link to the web site that describes how to set up 2FA with the GlobalProtect VPN. https://duo.com/docs/paloalto

If you follow all of the steps from the beginning through "Add an Authentication Profile", you will just need to add the new DuoRADIUS Authenication Profile to the administrator accounts that you would like to have authenticated via Two-factor Authentication.

It works GREAT!

Kind regards,

Jeff