Duo and Palo don't challenge when user connect immediately after disconnect

FarzanaMustafa — Fri, 03 Jul 2020 06:12:55 GMT

We have Duo access gateway integrated with Global protect.

It works most as per expected. However there is a small issue.

When the client machine reboot , the user will go through the entire process to login the global protect. E.g

1. 1. They clicked the connect button on the Global Protect Client

2. 2. Then they wait until the Duo Windows pop up for asking domain credentials. Then redirect to next page to push or passcode.

3. 3. They completed the MFA challenge, then login

However, if they click disconnect and connect right after, they will get in straight away without getting prompted.

The manager wants this to be rectified that every time when the end user connect, they needed to be challenged with both Palo Alto and Duo.

PAN-OS 9.1.3

GP Majority is 5.1

Please help!

Re: Duo and Palo don't challenge when user connect immediately after discon

BPry — Sat, 04 Jul 2020 13:14:11 GMT

Sounds like you have cookie authentication setup correct?

FarzanaMustafa — Sun, 05 Jul 2020 23:51:16 GMT

We have duo access gateway setup, so disable the cookie is not an option.