topic Re: Multi-Factor Authentication for GlobalProtect in General Topics

Multi-Factor Authentication for GlobalProtect

OtakarKlier — Wed, 23 Sep 2015 15:48:30 GMT

Hello All,

I know the documetnation states to use a certificate as one form of authentication or hte mult-factor. However has anyone out there setup different authentication profiles for their portal and gateway configs? I'm wondering if setting up say radius otp for one and ldap/AD for the other.

Thoughts?

Re: Multi-Factor Authentication for GlobalProtect

pankaku — Wed, 23 Sep 2015 15:56:20 GMT

Are you trying so say that One authentication profile will be Certificate but the other one will be RADIUS or LDAP?

Re: Multi-Factor Authentication for GlobalProtect

OtakarKlier — Wed, 23 Sep 2015 15:57:37 GMT

Sorry for not clarifying, but no. One method would be radius and the other would be ldap/AD.

Re: Multi-Factor Authentication for GlobalProtect

pankaku — Thu, 24 Sep 2015 09:18:14 GMT

I have tested the following and it worked perfect:

Portal authentication:

LDAP and client certificate

Gateway authentication:

RADIUS and client certificate

However I have not tested RADIUS with OTP but it should work.

Please try and update us

Rate the helpful answer.

Re: Multi-Factor Authentication for GlobalProtect

OtakarKlier — Fri, 25 Sep 2015 15:43:56 GMT

Thanks for the verification! I also just did this and its working as designed :). It would be nice if PAN would ask for both credentials in the initial logon, similar to what CIsco AnyConnect does. I'll put it in as an enhancement request.

Re: Multi-Factor Authentication for GlobalProtect

ulti — Fri, 25 Sep 2015 21:03:38 GMT

used duosecurity as MFA solution. its a bit of a hack to work with palo, with poor instructions and has limitations but once it works it does work smoothly.