GlobalProtect VPN prelogon 2FA/MFA

jk0neil — Wed, 17 Jul 2019 07:47:33 GMT

Hello everyone,

I have a question for which I can't find any documentation to solve it.

Our security manager wants to increase security at the VPN prelogon.

Since version 9.0 PANOS, its possible to make a VPN prelogon with 2FA or SAML authentication.

Is it possible that the 2FA/SAML authentication phase will take place before the VPN prelogon tunnel is formed?

In the documentation it is stated that this 2FA/SAML authentication phase takes place after the formation of the VPN tunnel (which is secured with a machine certificate for tunnel access).

Can we do this 2FA/SAML authentication phase before the formation of the prelogon VPN tunnel since in the configuration of the globalProtect its possible to secure the portal or gateway with a SAML server?

Have a great day,

Re: GlobalProtect VPN prelogon 2FA/MFA

Infrastructure_TBS — Wed, 17 Jul 2019 18:15:22 GMT

At the beginning of the documentation that you shared it says: "The GlobalProtect app for Windows and Mac endpoints now supports pre-logon followed by two-factor authentication for user login." For my understanding, the pre-logon continues to be the same with the machine certificate, but for the user to login you can use the 2FA.

topic GlobalProtect VPN prelogon 2FA/MFA in General Topics

GlobalProtect VPN prelogon 2FA/MFA

Re: GlobalProtect VPN prelogon 2FA/MFA