Global Protect Next TokenCode Mode

[SteveMcBride]

Hi all,

 Just wondering what I am missing in terms of getting the GlobalProtect Portal and Gateway to show next token prompts etc.

I have a fairly straightforward ISE RADIUS setup that talks to RSA AM. The authentication and authorization works except when next tokencode mode is invoked as no prompts are seen to indicate the next token is required. I can see the radius server sending the access-challenge to the client but nothing happens on either the portal or gateway,

[BPry]

@SteveMcBride

I don't believe that feature is actually supported at this time, but you might want to reach out to your SE to get formal verification. If not (and I fully believe it isn't) you could ask for the Feature Request number and add/create a request for this and share it here so others can find it and add their votes if it's something they could actually use. 

[Remo]

Hi @SteveMcBride 

What GP version do you use? How does your GP setup look like (on-demand/pre-logon/user-logon, is SSO enabled ...)? Does your ISE forward the access-challenge packet to the firewall?

Depending on your actual configuration this should work with MFA.

[SteveMcBride]

Hi all,

thanks for your replies. I have done further works and would like to share my finding and/or errors 😜

Basically what I have found to date is that I can't get this to work successfully with anything other than PAP. Initially I utilised EAP-GTC and am able to successfully authenticate and connect when there is no token issue. Problem with EAP-GTC is when next tokencode mode is invoked the messages just will not appear on the GP client. When I change the protocol back to PAP the prompts and tokencode process work as expected.

I have not been able to ascertain whether the issue is with ISE, Palo or indeed the RSA 8.1 server. I am going to post this on the other appropriate forums to see what I find and will update this post accordingly. I mainly post in case anyone else has this issue in the future.