topic Re: MFA "SSL Connect Error" in General Topics

MFA "SSL Connect Error"

Sly_Cooper — Tue, 04 Sep 2018 17:03:28 GMT

I am testing Multi Factor Authentication with Okta. I have configured everything (including certificate profile) as per the guide as well as Okta specific YouTube video, The first factor (active directory auth) is working fine, however, I am getting "SSL Connect Error" in the authentication logs. I could see the 443 connections going to Okta. How can I troubleshoot the issue? How do I get visibility in the SSL connect error?

> test mfa-vendors mfa-server-profile <mfa-profile-name>

{"res":"FAIL","msg":"SSL connect error"}

Re: MFA "SSL Connect Error"

Sly_Cooper — Tue, 04 Sep 2018 18:06:23 GMT

I captured the traffic and can see that the firewall is using TLS 1.0 for auth requests. Is there any way to enforce TLS 1.2? Okta has enforced TLS 1.2.

Re: MFA "SSL Connect Error"

Willowjw — Thu, 06 Sep 2018 06:49:56 GMT

We are encountering exact same issue the only difference is we are unable to find any attempt traffic against Okta. Keen to find out a way to see more "SSL Connect Error"

Re: MFA "SSL Connect Error"

Sly_Cooper — Thu, 06 Sep 2018 15:05:07 GMT

The firewall I am testing MFA on, is in the internal network and I have one more PAN firewall on the internet edge. I did packet capture to confirm behavior from the PAN firewall (TLS 1.0) and my machine browser (TLS 1.2).

Re: MFA "SSL Connect Error"

Sly_Cooper — Thu, 06 Sep 2018 16:04:15 GMT

@Willowjw

As per PAN support,

It is a known issue - PAN-95152 (TLS connection to Okta server is rejected because of TLS 1.0 from FW). It is reported on 8.1.0 and fixed versions are 8.0.13 (release ETA 27 sept), 8.1.2.

Re: MFA "SSL Connect Error"

Retired Member — Fri, 07 Sep 2018 00:08:49 GMT

hi, this will be fixed in the next minor release of PANOS, 8.0.13 and 8.1.2

Re: MFA "SSL Connect Error"

bspilde — Tue, 02 Oct 2018 20:14:04 GMT

I didn't see PAN-95152 in the release notes for 8.0.13. However, after upgrading to 8.0.13 my MFA cert profile issue disappeared and is successfully authenticating users hitting authentication policies now.

I am not getting prompts in GlobalProtect for non-web based applications still. That doesn't work on 8.1.3 either. I had it working in the 8.0.0 beta but hadn't tried it out since but now have a use case.