Multi-Factor Authentication for GlobalProtect

[OtakarKlier]

Hello All,

I know the documetnation states to use a certificate as one form of authentication or hte mult-factor. However has anyone out there setup different authentication profiles for their portal and gateway configs? I'm wondering if setting up say radius otp for one and ldap/AD for the other.

Thoughts?

[pankaku]

Are you trying so say that One authentication profile will be Certificate but the other one will be RADIUS or LDAP?

[OtakarKlier]

Sorry for not clarifying, but no. One method would be radius and the other would be ldap/AD.

[pankaku · Accepted solution]

I have tested the following and it worked perfect:

Portal authentication:

LDAP and client certificate

Gateway authentication:

RADIUS and client certificate

However I have not tested RADIUS with OTP but it should work. 

Please try and update us

Rate the helpful answer.

[OtakarKlier]

Thanks for the verification! I also just did this and its working as designed :). It would be nice if PAN would ask for both credentials in the initial logon, similar to what CIsco AnyConnect does. I'll put it in as an enhancement request.

[ulti]

used duosecurity as MFA solution. its a bit of a hack to work with palo, with poor instructions and has limitations but once it works it does work smoothly.