topic Re: 2 factor authentication and radius on global protect in General Topics

2 factor authentication and radius on global protect

jdprovine — Fri, 11 May 2018 14:34:17 GMT

I see where you can do radius authentication on the global protect client, does that mean you can also do 2 factor authentication?

Re: 2 factor authentication and radius on global protect

Remo — Fri, 11 May 2018 14:46:33 GMT

Yes 😉

Re: 2 factor authentication and radius on global protect

jdprovine — Fri, 11 May 2018 15:05:50 GMT

@Remo

Is that done on the portal under the authentication?

Re: 2 factor authentication and radius on global protect

Remo — Fri, 11 May 2018 15:08:40 GMT

It depends on your needs: under authentication of the portal and/or the gateway

Re: 2 factor authentication and radius on global protect

jdprovine — Fri, 11 May 2018 15:10:01 GMT

@Remo

So could you put radius on the portal and LDAP on the gateway

Re: 2 factor authentication and radius on global protect

Remo — Fri, 11 May 2018 15:27:02 GMT

Yes, this is possible. Now I don't knlw enough about what you plan to do, but this sounds like you should also configure the same radius profile on the gateway and use authentication cookies to force the users not too much to login.

Re: 2 factor authentication and radius on global protect

OtakarKlier — Fri, 11 May 2018 16:04:43 GMT

Hello,

What I did in the past previous to 7 or 8, wsa the setup a different authentication method for the portal and gateway. This way one would prompt for the external OTP and then the users would get prompted for their network creds. I never tried it with an authentication sequence but it might work that way as well?

Regards,

Re: 2 factor authentication and radius on global protect

jdprovine — Fri, 11 May 2018 16:30:09 GMT

@OtakarKlier

So what was your portal set to use? what was your gateway set to use? I think you are doing what I am trying to do. I am trying to replace a VPN that use Radius, OTP and LDAP to access a segregated part of our network using a ASA 5510 FW

Re: 2 factor authentication and radius on global protect

OtakarKlier — Fri, 11 May 2018 16:35:08 GMT

Hello @jdprovine,

I set the portal to use the external OTP and the gateway to use RADIUS(active directory creds. Sounds like you would like 3 options?)

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentication/set-up-two-factor-authentication

If using 3 options, then maybe look at:

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/globalprotect-features/authentication-policy-and-multi-factor-authentication-for-globalprotect

Just thinking out loud.

Cheers!

Re: 2 factor authentication and radius on global protect

jdprovine — Fri, 11 May 2018 16:37:25 GMT

@OtakarKlier

I will check out your links, not sure I want to user 3 methods I just know that it was set up for the VPN I am trying to replace, not sure why it was set up that way or if I can do the same thing on the PA