topic Re: GlobalProtect to Facilitate Multi-Factor Authentication Notifications in General Topics

GlobalProtect to Facilitate Multi-Factor Authentication Notifications

zthiel — Wed, 07 Mar 2018 21:33:08 GMT

I'm working on setting this up, however when the popup box appears on the laptop wanting me to click on the link for additional authentication I am brought to a webpage saying the connection has timed out. Now the url is going after <ip address>:6081. If I do a port scan against the IP address I do not see it listening on port 6081. I have wide open access to the backend IP address.

Any suggestions?

Re: GlobalProtect to Facilitate Multi-Factor Authentication Notifications

zthiel — Wed, 07 Mar 2018 21:33:42 GMT

Article I am using for setup:

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentication/configure-globalprotect-to-facilitate-multi-factor-authentication-notifications.html

Re: GlobalProtect to Facilitate Multi-Factor Authentication Notifications

BPry — Wed, 07 Mar 2018 22:10:11 GMT

@zthiel,

Are you being directed towards your MFA source or are you being directed to the firewall?

Re: GlobalProtect to Facilitate Multi-Factor Authentication Notifications

zthiel — Thu, 08 Mar 2018 13:58:35 GMT

I am being directed to the interface IP that I have setup on the External GlobalProtect Gateway as shown on the diagram. That IP address I have setup on the Captive Portal config (redirect section) of our device that is shown as the MFA Gateway on the diagram.

Re: GlobalProtect to Facilitate Multi-Factor Authentication Notifications

Brandon_Wertz — Sat, 10 Mar 2018 15:56:22 GMT

I'm faily certain that based on what you described it sounds like you're being directed back to your firewall, as you should, to enforce your MFA requirements.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/firewall-administration/reference-port-number-usage/ports-used-for-management-functions

It's kinda weird to see, but Palo appends your destination site, with specific syntax / port usage to enforce cetain policies like MFA / 'Click to Continue' URL options.

--Edit--

So the IP that you're seeing in the URL bar is really your desitination IP address, and the port your're also seeing (6081) is actually being refrenced to your firewall not the port actually being opened on the destination IP address.

Re: GlobalProtect to Facilitate Multi-Factor Authentication Notifications

V.Singh504229 — Wed, 09 Apr 2025 13:32:06 GMT

Hi all, I tried to do the same but after doing all the configuration i am not getting the GP notification popup. I tried on different Software version but no luck. Could you please help.