Vpn access using GlobalProtect with AUTENTICATION TWO-FACTOR

[cverniani]

We have

The company want  that all people accessing from GLOBAL PROTECT vpn CLIENT use the two-factor autentication. We have released an U2F USB security usb key for the email. 

Does PaloAltoNetork support an external Two-Factor Autentication for the VPN? If no there are plan to develop it?

For us is very important the VPN GLOBAL PROTECT client can have a two-factor autentication to avoid user password theft.

Waiting for news.

Best Regards

Claudio Verniani

[BPry]

@cverniani,

GlobalProtect supports two-factor authentication, but to really detail how you would get it to function we would need to know what system you are actually using. Things get slightly more complicated and less user friendly depending on the multi-factor system. 

[cverniani]

Thanks a lot for your Reply. I have two PA-820 in Ha mode, with this configuration /license.

Model PA-820
Serial # XXXXXXX
Software Version 9.0.3
GlobalProtect Agent 4.1.12
Application Version 8172-5560 (07/17/19)
Threat Version 8172-5560 (07/17/19)
Antivirus Version 3041-3551 (07/16/19)
WildFire Version 367018-369729 (07/17/19)
URL Filtering Version 20190717.20094
GlobalProtect Clientless VPN Version 0
Time Wed Jul 17 08:12:10 2019
Uptime

0 days, 16:26:23

Software Version 9.0.3

This is the Global Protect Portal Configuration

 

I can change the autentication policy. I an enable the easyest autentication (2 factor) that works with PaloAlto.

@BPry an you kindly indicate me some documentation?

Best Regards

Claudio Verniani

[Chacko42]

@cverniani: Please provide the name of the solution, you are using.

For example RSA USB tokens are natively supported (see here https://www.paloaltonetworks.com/partners/alliance or search for your solution)