I have configured GP with multifactor authentication.
Example:- If I want to connect VPN, so I click to connect on agent it will prompt me to credential then I will enter username and password once it is succeded one OTP received my mobile. after entering the OTP. I can connect the VPN
Randomly I am facing issues some users not able to connect VPN if they enter credentials(5-6 times) the error occurs user name password is incorrect.
Workaround - I remove all the settings from the agent and enter the portal name after that I can able to log in.
Highlight points:- When I did the troubleshooting:-
1) I can see the error - (Auth FAILED for user "ABC" thru <"MFA-VPN", "vsys1">: remote server 10.20.182.42 of server profile "MFA-VPN-Radius" is down, or in retry interval, or request timed out (elapsed time 25 secs, max allowed 25 secs)
For this error, I went through some KB and found I need to increase the Global protect timeout.
2) When I test the authentication profile get the error -
Target vsys is not specified, user "ABC" is assumed to be configured with a shared auth profile.
Do allow list check before sending out authentication requests...
For this:- I can able to ping the RADIUS server and some users test authentication succeded and for the ABC user test is succeed sometimes.
3) In the portal and gateway setting, I didn't configure authentication override (Generate cookies and Accept cookies)
For this - It is mandatory to configure authentication override?
Please suggest to me what I need to do for this.
The PAN-OS version is 8.1.8 when I found the known issue:-
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!