VPN Two-Factor Authentication integration into PAN ?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

VPN Two-Factor Authentication integration into PAN ?

L4 Transporter

Hello all,

recently I learned the Two-Factor Authentication solution from DUO Security. Basically it requires a PAN FW, an AD/Radius Proxy software provided by DUO Security and an Account/API Key.

The Proxy software is the interface between AD/Radius and DUO Servers.

Since PAN already connects to an existing AD/Radius I am asking myself whether it would make sense to integrate the "proxy software" into PAN ? This would just require to enter the API Key in order to communicate with the DUO Servers on 443 and the extra proxy software is not required anymore.

This is valid for other Cloud OTP vendors as well, same technology.

I remember that a competitor in the firewall market did have or still has such a feature built in.

What do you think ? Is this worth a feature request ?

rgds

Roland

11 REPLIES 11

L6 Presenter

To me it sounds odd that you need to install a "proxysoftware" in order to be able to speak to the authserver.

The authserver should be able to speak standardized protocols such as radius for the authentication.

That is the client sends its credentials to the PA device. The PA device uses radius to ask the authserver (the OTP device) if the stuff the client sent is ok or not and then the authserver replies to this request which the PA will then either grant or deny access for the client.

Look here for some info on the topic (integration between nordicedge and PA devices for use of OTP): Strong authentication for Palo Alto Secure Access SSL VPN Solutions | Nordic Edge | The Provider of...

Well actually that was not my point, but even with NordicEdge (now McAfee) you need a local installation of a piece of software, they call it OTPServer same thing.

Yes but this server is the authserver itself, not a proxy that needs to be installed on the component asking for authorize incoming clients.

Same is true for the Duo Security Solution, don't get confused by product names.

ahh, sorry about that 🙂

L4 Transporter

Today I have configured and tested the Duo Security Two Factor Authentication with Global Protect and it works like a charm. All in all it took me about 45Mins. to get everything working (mostly because of waiting for the commit to be finished 🙂

Means installing and configuring  the Authentication Proxy Software provided by Duo on the Windows server, registering for a free Duo Account (up to 10 users free) and reconfiguring the PAN Firewall to use the authentication proxy as a Radius Server.

I really like the Duo Push functionality which makes it very easy and secure for an enduser to authenticate to the GP VPN.

I would love to see this integrated into the PAN Firewall out of the box as with this approach the authentication proxy would be obsolete.

Roland

Were you able to get the duo to work with the default integration (radius_server_iframe)?  I was told to drop back to using the radius_server_concat method, which is a bit rough around the edges.

My problem was that the global protect authentication dialog for the second factor would pop up with script in the prompt....

Thanks,

J

You have to use the radius_server_concat method. The iframe method is needed for web based portal authentication like Citrix Access Gateway and such.

Example config:

[main]

client=ad_client

server=radius_server_concat

[ad_client]

host=IP_ADDRESS_OF_AD_SERVER

service_account_username=AD_USERNAME

service_account_password=AD_USERNAME_PASSWORD

search_dn=dc=COMPANY,dc=COM

[radius_server_concat]

api_host=API_HOST_ID.duosecurity.com

ikey=INTEGRATION_KEY

skey=SECURITY_KEY

failmode=safe

radius_ip_1=PAN_FW_IP_ADDRESS

radius_secret_1=RADIUS_PASSWORD

Thanks for the quick response-- that looks exactly like what I have configured.

I'm just not sure about the need to specify the method (SMS,PUSH, etc.) on the password line. Change is hard when it comes to stuff like this and our users!

Still, it is a very flexible system and seems like a good fit for us outside of that one issue...

J

I'm just not sure about the need to specify the method (SMS,PUSH, etc.) on the password line. Change is hard when it comes to stuff like this and our users!

That's what I call a flexible system. We have a customer who decided to allow non privileged users to save password,push in the GP client and have them approve the authentication request on their smartphone. That's convenient.

Not applicable

We tested solution SecurAccess from company SecurEnvoy. Is working well wilt PA for WIN/MAC GP. This is one solution where is possible use own GSM gateway for send SMS I found and reason I am writing.

Only I can't use native GP on Android phone for two auth currently.

Z.

  • 4892 Views
  • 11 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!