topic Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl in General Topics

Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properly

Victor.Newsom — Tue, 26 Jun 2018 14:41:10 GMT

I am currently testing Multifactor Authentication using a Radius Server.

1. I have a test group of users who have been configured on my Radius Server

2. The MFA Radius server is alway reachable via ping/icmp at all times

3. MFA via the Radius Server works as normal for a time period ranging from 24-72 hours (i.e users log in using Global Protect Client and after entering in their Active Directory credentials, they then receive a code via text. Once they enter the code, they are allowed acces to the netowrk.

4. After 24-72 hours, users in my test group no longer receive an autentication code via text after loggin in to the Global Protect Client. After they enter their AD credentials, they are allowed access to the network.

5. In order to get MFA functioning properly again, I have to reboot the MFA Server

Has anyone experienced and resolved this issue?

Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl

BPry — Tue, 26 Jun 2018 19:25:33 GMT

@Victor.Newsom,

If you are having to reboot your MFA Server it would appear as though it's more of an issue with that server and not really the firewall at all.

Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl

Victor.Newsom — Tue, 26 Jun 2018 19:36:51 GMT

Thanks for the response...I am just trying to rule out all possibilities.

Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl

OtakarKlier — Tue, 26 Jun 2018 21:20:57 GMT

Hello,

If a test user is dropped after the lifetime and cannot log back in, can other test users still authenticate, i.e. ones that have not been timed out?

Just thinking out loud.

Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl

Victor.Newsom — Tue, 26 Jun 2018 21:35:41 GMT

Thanks for the response. See my comments below

When MFA stops working, it stops working for all users in the test group. The login scenario sometimes is as follows

Test Users login on day 1: MFA functions properly ( users enter their ad credentials, receive code via text, enter code, access to network granted)

Test Users login on day 2: MFA does not function properly (user enters their ad credentials, no code is received but access to network is granted)

Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl

OtakarKlier — Tue, 26 Jun 2018 21:43:56 GMT

Do you have cookies enabled for the GP clients?

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentication/about-globalprotect-user-authentication/how-does-the-agent-or-app-know-what-credentials-to-supply/cookie-authentication-on-the-portal-or-gateway

Re: Multi Factor Authentication Raduis Server Must be Restarted in order for MFA to Function Properl

Victor.Newsom — Mon, 16 Jul 2018 13:59:01 GMT

Yes I do and thanks for your response. It is appearing that this issue may be related to the PanOS Version that I am running.