recently I learned the Two-Factor Authentication solution from DUO Security. Basically it requires a PAN FW, an AD/Radius Proxy software provided by DUO Security and an Account/API Key.
The Proxy software is the interface between AD/Radius and DUO Servers.
Since PAN already connects to an existing AD/Radius I am asking myself whether it would make sense to integrate the "proxy software" into PAN ? This would just require to enter the API Key in order to communicate with the DUO Servers on 443 and the extra proxy software is not required anymore.
This is valid for other Cloud OTP vendors as well, same technology.
I remember that a competitor in the firewall market did have or still has such a feature built in.
What do you think ? Is this worth a feature request ?
To me it sounds odd that you need to install a "proxysoftware" in order to be able to speak to the authserver.
The authserver should be able to speak standardized protocols such as radius for the authentication.
That is the client sends its credentials to the PA device. The PA device uses radius to ask the authserver (the OTP device) if the stuff the client sent is ok or not and then the authserver replies to this request which the PA will then either grant or deny access for the client.
Look here for some info on the topic (integration between nordicedge and PA devices for use of OTP): Strong authentication for Palo Alto Secure Access SSL VPN Solutions | Nordic Edge | The Provider of...
Today I have configured and tested the Duo Security Two Factor Authentication with Global Protect and it works like a charm. All in all it took me about 45Mins. to get everything working (mostly because of waiting for the commit to be finished :-)
Means installing and configuring the Authentication Proxy Software provided by Duo on the Windows server, registering for a free Duo Account (up to 10 users free) and reconfiguring the PAN Firewall to use the authentication proxy as a Radius Server.
I really like the Duo Push functionality which makes it very easy and secure for an enduser to authenticate to the GP VPN.
I would love to see this integrated into the PAN Firewall out of the box as with this approach the authentication proxy would be obsolete.
Were you able to get the duo to work with the default integration (radius_server_iframe)? I was told to drop back to using the radius_server_concat method, which is a bit rough around the edges.
My problem was that the global protect authentication dialog for the second factor would pop up with script in the prompt....
You have to use the radius_server_concat method. The iframe method is needed for web based portal authentication like Citrix Access Gateway and such.
Thanks for the quick response-- that looks exactly like what I have configured.
I'm just not sure about the need to specify the method (SMS,PUSH, etc.) on the password line. Change is hard when it comes to stuff like this and our users!
Still, it is a very flexible system and seems like a good fit for us outside of that one issue...
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!