Global protect multifactor authentication with RADIUS

Jafar_Hussain — Wed, 22 Apr 2020 20:45:20 GMT

Dear All,

I have configured GP with multifactor authentication.

Example:- If I want to connect VPN, so I click to connect on agent it will prompt me to credential then I will enter username and password once it is succeded one OTP received my mobile. after entering the OTP. I can connect the VPN

Randomly I am facing issues some users not able to connect VPN if they enter credentials(5-6 times) the error occurs user name password is incorrect.

Workaround - I remove all the settings from the agent and enter the portal name after that I can able to log in.

Highlight points:- When I did the troubleshooting:-

1) I can see the error - (Auth FAILED for user "ABC" thru <"MFA-VPN", "vsys1">: remote server 10.20.182.42 of server profile "MFA-VPN-Radius" is down, or in retry interval, or request timed out (elapsed time 25 secs, max allowed 25 secs)

For this error, I went through some KB and found I need to increase the Global protect timeout.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNmaCAG

2) When I test the authentication profile get the error -

Target vsys is not specified, user "ABC" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication requests...

For this:- I can able to ping the RADIUS server and some users test authentication succeded and for the ABC user test is succeed sometimes.

3) In the portal and gateway setting, I didn't configure authentication override (Generate cookies and Accept cookies)

For this - It is mandatory to configure authentication override?

Please suggest to me what I need to do for this.

Re: Global protect multifactor authentication with RADIUS

Jafar_Hussain — Wed, 22 Apr 2020 20:48:07 GMT

The PAN-OS version is 8.1.8 when I found the known issue:-

PAN-97757

GlobalProtect authentication fails with an Invalid username/password error (because the user is not found in Allow List) after you enable GlobalProtect authentication cookies and add a RADIUS group to the Allow List of the authentication profile used to authenticate to GlobalProtect.
Workaround: Disable GlobalProtect authentication cookies. Alternatively, disable (clear) Retrieve user group from RADIUS in the authentication profile and configure group mapping from Active Directory (AD) through LDAP

topic Re: Global protect multifactor authentication with RADIUS in General Topics

Global protect multifactor authentication with RADIUS

Re: Global protect multifactor authentication with RADIUS