Setting up dual authentication or single authentication based on the user group in global protect

cancel
Showing results for 
Search instead for 
Did you mean: 

Setting up dual authentication or single authentication based on the user group in global protect

L4 Transporter

Hi All,

 

We have the requirement where we have to setup dual authentication for some set (Group) of  user and single authentication for remaining global protect user. Is this duable? if yes, please provide info.

Note : We have the single gateway.

 

Regards,

Guru

1 REPLY 1

Hi @Gururaj
Are you using PAN-OS 8.0.x?

I would setup two Authentication profiles and one Authentication Sequence profile.
For example:
Authentication profiles:

  • LDAP-PROFILE01
    • Two Factor: Enabled
    • Advanced: Specify the AD group you want to enforce two factor authenticantion
  • LDAP-PROFILE02
    • Two Factor: Disabled
    • Advanced: Specify "All" or the specific AD group which should not have two factor authentication enforced

Authentication Sequence:

  • LDAP-AUTH-SEQUENCE
    • Add LDAP-PROFILE01
    • Add LDAP-PROFILE02

Note: The authentication sequence will try to match the username against each one of the profiles above in a sequence, once it matches, and access is validated the access is granted.

 

GlobalProtectPortal

  • Specify the LDAP-AUTH-SEQUENCE Profile

GlobalProtect Gateway

  • Specify the LDAP-AUTH-SEQUENCE Profile

You can still speicify in the User/Group tab inside the portal and gateway configuration the AD groups you want to allow, but the auth factor will be enforced via the profiles created before.

 

I hope it makes sense.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!