2 factor authentication and radius on global protect

[jdprovine]

I see where you can do radius authentication on the global protect client, does that mean you can also do 2 factor authentication?

[Remo]

Yes 😉

[jdprovine]

@Remo

Is that done on the portal under the authentication?

[Remo]

It depends on your needs: under authentication of the portal and/or the gateway

[jdprovine]

@Remo

So could you put radius on the portal and LDAP on the gateway

[Remo]

Yes, this is possible. Now I don't knlw enough about what you plan to do, but this sounds like you should also configure the same radius profile on the gateway and use authentication cookies to force the users not too much to login.

[OtakarKlier]

Hello,

What I did in the past previous to 7 or 8, wsa the setup a different authentication method for the portal and gateway. This way one would prompt for the external OTP and then the users would get prompted for their network creds. I never tried it with an authentication sequence but it might work that way as well?

Regards,

[jdprovine]

@OtakarKlier

So what was your portal set to use? what was your gateway set to use?  I think you are doing what I am trying to do. I am trying to replace a VPN that use Radius, OTP and LDAP to access a segregated part of our network using a ASA 5510 FW

[OtakarKlier]

Hello @jdprovine,

I set the portal to use the external OTP and the gateway to use RADIUS(active directory creds. Sounds like you would like 3 options?)

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/authentica...

If using 3 options, then maybe look at:

https://www.paloaltonetworks.com/documentation/80/pan-os/newfeaturesguide/globalprotect-features/aut...

Just thinking out loud.

Cheers!

[jdprovine]

@OtakarKlier

I will check out your links, not sure I want to user 3 methods I just know that it was set up for the VPN I am trying to replace, not sure why it was set up that way or if I can do the same thing on the PA