Always -on OTP

[SThatipelly]

I have an interesting scenario where I have a firewall protecting an extremely sensitive server and some dedicated users accessing it through another zone. I ran into a situation where only couple of users need access to it when remote. I thought of implementing always-on vpn but what if they loose their laptops? I heard OTP with always on vpn can address this issue but it raised some questions. what if they donot have otp? does that mean they don't have any internet(browsing) access?

[OtakarKlier]

Hello,

Please correct me if I am offbase, however I'll try and answer:

what if they donot have otp?

They will need something. Always on can be used with certificates, LDAP, RADIUS, etc. OTP is recommended since its a time based token that only works once.

does that mean they don't have any internet(browsing) access?

This can also be setup/allowed. It all depends on if you want the userse accessing hte internet while having access to those sensitive systems.

Hope that helps!

[SThatipelly]

@OtakarKlier We dont want those users browsing internet before authenticating to portal. In short I mean to say if the PC is lost and the robber shouldn't get access to this vpn. We use RADIUS for OTP authentication though. can you please shed some light on that setup?

[OtakarKlier]

Hello,

Sorry i misunderstood hte question. I think you might be looking for a solution such as VPN before logon:

https://live.paloaltonetworks.com/t5/Configuration-Articles/Basic-GlobalProtect-Configuration-with-P...

Please let me know if I am offbase. As for the RADIUS or LDAP setup, it would bve in the GlobalProtect Portal and/or Gateway configuration.

Hope that helps.