Setting up DUO MultiFactor on GlobalProtect and allowing AD password resets at the same time

[MiltonM_Annuity]

Hello all,

I am currently trying to set up my GlobalProtect portal to allow my users to reset their passwords when they expire. I was able to do that by setting up my RADIUS profile with PEAP-MSCHAPv2 however now my users are not getting the DUO pushes anymore. It was previously working with the DUO authentication proxy. I need to be able to set up the portal so that it can do both. Has anyone had success doing this? I would really appreciate it if someone can point me in the right direction

GlobalProtect 

[BPry]

@MiltonM_Annuity,

Briefly searching, it looks like Duo actually does support in-line password resets as long as the Duo Authentication Proxy configuration is set to use MS-CHAPv2 and the firewall is updated away from the default PEAP that Duo recommends in their setup guide. 

https://help.duo.com/s/article/5797?language=en_US#:~:text=Does%20the%20Duo%20Authentication%20Proxy....