Global protect multifactor authentication with RADIUS

Reply
Highlighted
L4 Transporter

Global protect multifactor authentication with RADIUS

Dear All,

 

I have configured GP with multifactor authentication.

Example:- If I want to connect VPN, so I click to connect on agent it will prompt me to credential then I will enter username and password once it is succeded one OTP received my mobile. after entering the OTP. I can connect the VPN

 

Randomly I am facing issues some users not able to connect VPN if they enter credentials(5-6 times) the error occurs user name password is incorrect.

Workaround - I remove all the settings from the agent and enter the portal name after that I can able to log in.

 

Highlight points:- When I did the troubleshooting:-

 

1) I can see the error -   (Auth FAILED for user "ABC" thru <"MFA-VPN", "vsys1">: remote server 10.20.182.42 of server profile "MFA-VPN-Radius" is down, or in retry interval, or request timed out (elapsed time 25 secs, max allowed 25 secs)

For this error, I went through some KB and found I need to increase the Global protect timeout.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNmaCAG

 

2) When I test the authentication profile get the error -

Target vsys is not specified, user "ABC" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication requests...

For this:- I can able to ping the RADIUS server and some users test authentication succeded and for the ABC user test is succeed sometimes.

 

3) In the portal and gateway setting, I didn't configure authentication override (Generate cookies and Accept cookies)

For this - It is mandatory to configure authentication override?

 

 

Please suggest to me what I need to do for this.

Highlighted
L4 Transporter

The PAN-OS version is 8.1.8 when I found the known issue:-

PAN-97757

 

GlobalProtect authentication fails with an Invalid username/password error (because the user is not found in Allow List) after you enable GlobalProtect authentication cookies and add a RADIUS group to the Allow List of the authentication profile used to authenticate to GlobalProtect.
Workaround: Disable GlobalProtect authentication cookies. Alternatively, disable (clear) Retrieve user group from RADIUS in the authentication profile and configure group mapping from Active Directory (AD) through LDAP
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!