End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

[HarryScore]

I need some advices on this GP VPN Client with MFA issue: 

End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

The current auth environment is that users use Active Directory in Azure  for MFA and use Radius to authentication process in Globalprotect.

[JayGolf]

Hi @HarryScore ,

How long do you have timeout setup for RADIUS? 

[HarryScore]

@JayGolf  current Radius timeout setup is 30 secs

is there a way to check GP timeout setting? 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBufCAG&lang=en_US%E2%80%A...

[kiwi]

Hi @HarryScore ,

Source: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBufCAG&lang=en_US%E2%80%A...

>configure
# set deviceconfig setting global-protect timeout 90
#commit

# show deviceconfig setting global-protect
global-protect {
  timeout 90;
}
# exit

Hope this helps,

Kim.

[Brandon_Wertz]

---

@HarryScore wrote:

I need some advices on this GP VPN Client with MFA issue: 

End users selects DENY on the MFA prompt on the phone still are able to connect to GlobalProtect agents

The current auth environment is that users use Active Directory in Azure  for MFA and use Radius to authentication process in Globalprotect.

---

This isn't exactly your question, but can you do MFA from Azure?  If you tie the MFA from Azure it's an easier way to enforce the MFA process from an Azure authentication, vice letting the downstream system enforce it.  Also doing it at the Azure level ensure you have a consistent MFA process.

[JayGolf]

@HarryScore ,

Try setting the timeout to at double of what you set up in Radius. If that doesn't work, I'd try increasing your radius to 60 sec. 

[HarryScore]

Thanks everyone.

beside the radius server, we have another NPS server with NPS Extension for Azure MFA.

I have tried to setup the GP timeout to 90 secs, Radius server to 60 secs, still no luck.  Palo TAC doesn't help much either.

We are deploying Prisma now which should be resolve the issue.