GlobalProtect Portal with DUO and LocalUser Scenario (without AD)

mxe2fmk — Sat, 22 Feb 2020 12:16:57 GMT

Good day!

Who know and can help:

Is scenario when it is working NGFW PA-220, LocalUser , GlobalProtect and Duo 2FA (without AD, RADIUS, LDAP etc.) for small users group (like 10 members vpn)?

I believe in that very simple way, but didn't found out information about it, and configuration example.

https://community.duo.com/t/paloalto-globalprotect-portal-with-duo-and-localuser-scenario-without-ad/6315

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/authentication/configure-multi-factor-authentication.html

https://help.duo.com/s/article/4254?language=en_US

https://www.reddit.com/r/paloaltonetworks/comments/9uq5os/globalprotect_and_duo_native_mfa/

Thanks.

Re: GlobalProtect Portal with DUO and LocalUser Scenario (without AD)

SutareMayur — Mon, 24 Feb 2020 11:24:52 GMT

Duo can't be used for MFA for local users of Palo Alto Global Protect. It seems to be limitation of PA devices. We tried same in the past in our environment and engineer said it's not possible. Even Duo have one article on it.

https://help.duo.com/s/article/2322?language=en_US

Duo MFA solution for Captive Portal of Palo Alto will work with a local database but i think it will not fulfill your use case.

Hope it helps!

Mayur

topic Re: GlobalProtect Portal with DUO and LocalUser Scenario (without AD) in General Topics

GlobalProtect Portal with DUO and LocalUser Scenario (without AD)

Re: GlobalProtect Portal with DUO and LocalUser Scenario (without AD)