Global Protect MFA with Google Authenticator

[SandipKumbhar]

Dear Team, 

Please help me understand can we configure TOTP Google Authenticator(Free) for Global Project VPN users 

we have configured Global Protect VPN with AD authentication and want to configure the above solution.

Thanks in Advance 

Regards 

Sandip Kumbhar

[TomYoung]

Hi @SandipKumbhar ,

PAN-OS does not support Google MFA natively -> https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table#i....

One solution that you can use is a RADIUS server that supports both LDAP and Google TOTP, e.g. https://sysopstechnix.com/enable-2fa-on-freeradius-with-openldap-users/.  I just Googled that one.  I have not used it.

On the NGFW, all you do is configure the RADIUS server for GlobalProtect.  Check out the diagram in the 2nd URL.  If you do not want users to get prompted twice for MFA (portal and gateway), you can (1) enable authentication cookies or (2) use RADIUS for the portal and LDAP for your gateway.

Thanks,

Tom