How to configure two-factor auth in GlobalProtect

[ppatel · Accepted solution]

Hi Jeff,

You are right, it won't work.

You definitely need to have two ip-address for the gateways.

How about adding secondary ip on the interface and assigning second gateway profile to the secondary ip-address.

Example:-

Portal ip-    eth 1/3      10.30.6.54/24

                 eth 1/3     10.30.6.54/24 ( GW1)

                                10.30.6.110/32 (secondary ip)   (GW2)

One gateway :-  uses LDAP ,  tunnel.1

Another gateway :- uses Radius, tunnel.2

Should work. But will require gateway license.

Thanks

Parth

[jwolach]

Hi Parth,

I had the same idea in mind however, I can't put a secondary IP on the interface because I only have one Public IP address for that interface.  But, I see that would potentially work.

Thx for all of your help!

[kevin_thys]

Hi Ppatel,

I have for GP-portal ldap with attribute mail. In Radius RSA usernames are mail addres. But doen't work, when I captured radius packets comming from PA I saw the username mail addres is changed to domain.com\user.

So summary:

Portal:

username: user1@domain.com

pwd: AD password

GW:

username send to RSA: domain.com\user1

pwd: OTP.

But I get an error from RSA because he's waiting for user1@domain.com.

Can this issue be solved? RSA users are only known by mail addres.

Regards,

Kevin

[jcostello]

Kevin

How about swapping the authentication profile for the Portal and the Gateway - RADIUS authentication on Portal and LDAP on the Gateway. RADIUS will push the user1@domain.com to the gateway and then prompt. Not the typical configuration but will still do two factor authentication.