How to configure two-factor auth in GlobalProtect

Reply
L4 Transporter

Re: How to configure two-factor auth in GlobalProtect

Hi Jeff,


You are right, it won't work.

You definitely need to have two ip-address for the gateways.


How about adding secondary ip on the interface and assigning second gateway profile to the secondary ip-address.

Example:-

Portal ip-    eth 1/3      10.30.6.54/24

                 eth 1/3     10.30.6.54/24 ( GW1)

                                10.30.6.110/32 (secondary ip)   (GW2)

One gateway :-  uses LDAP ,  tunnel.1

Another gateway :- uses Radius, tunnel.2

Should work. But will require gateway license.


Thanks

Parth

L4 Transporter

Re: How to configure two-factor auth in GlobalProtect

Hi Parth,

I had the same idea in mind however, I can't put a secondary IP on the interface because I only have one Public IP address for that interface.  But, I see that would potentially work.

Thx for all of your help!

L3 Networker

Re: How to configure two-factor auth in GlobalProtect

Hi Ppatel,

I have for GP-portal ldap with attribute mail. In Radius RSA usernames are mail addres. But doen't work, when I captured radius packets comming from PA I saw the username mail addres is changed to domain.com\user.

So summary:

Portal:

username: user1@domain.com

pwd: AD password

GW:

username send to RSA: domain.com\user1

pwd: OTP.

But I get an error from RSA because he's waiting for user1@domain.com.

Can this issue be solved? RSA users are only known by mail addres.

Regards,

Kevin

Highlighted
L4 Transporter

Re: How to configure two-factor auth in GlobalProtect

Kevin

How about swapping the authentication profile for the Portal and the Gateway - RADIUS authentication on Portal and LDAP on the Gateway. RADIUS will push the user1@domain.com to the gateway and then prompt. Not the typical configuration but will still do two factor authentication.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!