Generate cookie vs Accept cookie

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Generate cookie vs Accept cookie

L3 Networker

Hi Team,

 

Can anyone explain what Generate cookie and Accept cookie actually do? I always find myself messing with the cookie settings when enabling DUO/Azure SAML MFA but confused as to what the difference is and what they do.

 

Schneur_Feldman_0-1680710262228.png

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

GP Agent first connects to portal to pull down list of gateways.

Then it will connect to one of gateways (either based on priority or latency but this is different topic).

GP Agent will cache list of gateways. By default for 24 hours.

 

So every 24 hours GP Agent needs to connect to Portal to check if config has changed.

 

This causes user to accept DUO push for portal login and then right after second time for gateway login.

 

To overcome this you can configure portal to generate cookie and gateway to accept cookie with 1 minute timeout.

This means that if config has timed out in GP Agent and it connects to portal first portal will generate cookie and during second auth to gateway this cookie is used to authenticate instead of full SAML MFA.

 

If 1 minute passes, user disconnects and connect again then gateway don't accept any more this old cookie and SAML will be used with full blown 2FA auth.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

GP Agent first connects to portal to pull down list of gateways.

Then it will connect to one of gateways (either based on priority or latency but this is different topic).

GP Agent will cache list of gateways. By default for 24 hours.

 

So every 24 hours GP Agent needs to connect to Portal to check if config has changed.

 

This causes user to accept DUO push for portal login and then right after second time for gateway login.

 

To overcome this you can configure portal to generate cookie and gateway to accept cookie with 1 minute timeout.

This means that if config has timed out in GP Agent and it connects to portal first portal will generate cookie and during second auth to gateway this cookie is used to authenticate instead of full SAML MFA.

 

If 1 minute passes, user disconnects and connect again then gateway don't accept any more this old cookie and SAML will be used with full blown 2FA auth.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

So essentially if you want clients to only get one MFA push then the portal needs to generate a cookie and the gateway needs to be set to accept that cookie? This way the client is getting a push for the portal and gateway?

If portal generates cookie and gateway accepts cookie then there will be 1 push only - from portal.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi Raido,

Why is there even an option for the gateway client to generate cookies?  Does that ever happen and how does it affect which profile is chosen?  How can I see this behavior?  Could you show an example?  Maybe from the client logs?

Main reason to use cookie is to avoid sending multiple 2FA requests to user.

In some cases you don't want to enable 2FA on the portal but on gateway only.

For example you use LDAP auth on portal and 2FA auth on gateway.

In this case you want to generate and accept 2FA on gateway only.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 1 accepted solution
  • 1654 Views
  • 5 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!