Cisco DUO MFA with Radius under Global Protect

[Vijaygvasan]

Hi Folks,

We are trying to configure MFA under Radius using Cisco DUO.

We have done the configuration for MFA in firewall for the same.

Now we are facing some problem such as 'Reason: Invalid username/password. auth profile \'Duo_Auth\', vsys \'vsys1\', server profile \'Duo_Radius\', server address Failed to communicate with any Active Directory server\' From: x.x.x.x'

This is the error coming in system log.

Also when we tried to login with CLI using test authentication authentication-profile auth-profile username & passwork.

We received this below error message.

Target vsys is not specified, user "username" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "username" is in group "all"

Egress: No service source route is set, might use destination source route if configured
Authentication to RADIUS server at x.x.x.x:1812 for user "Username"
Authentication type: PAP
Now send request to remote server ...
Authentication failed against RADIUS server at x.x.x.x:1812 for user "Username"

Authentication failed for user "Username"

What could be the cause here let me know what could be done next.

Cheers

[TomYoung]

Hi @Vijaygvasan ,

You mentioned RADIUS.  Have you configured the Duo Authentication Proxy?  Here is a doc for GP, but the RADIUS config is the same regardless of the use case.  https://duo.com/docs/paloalto

Here is an overview of supported use cases and protocols for PANW MFA.  https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table.h...  Note that the MFA server profiles can only be used with the Authentication Policy for now.

Thanks,

Tom

[Vijaygvasan]

Could you please share any methods or documents to use Authentication policy using MFA.

Or some steps would be fine for that.

Cheers

[TomYoung]

Hi @Vijaygvasan ,

Sure!  Here is a doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HANzCAO&lang=en_US%E2%80%A....  That doc uses an MFA server profile.

With PANW and Duo, there are 4 ways to configure MFA:

1. RADIUS with Duo Authentication Proxy (free install from Duo on Windows server).
   1. The RADIUS server profile configured in the GP doc in the previous reply can also be applied to Auth Policy.
2. SAML with Duo Access Gateway (another free install on Windows).
   1. Here is a doc -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/configure-multi-factor-aut....
   2. The SAML server profile configured in this doc can also be applied to Auth Policy
3. SAML with Duo SSO.
   1. Can authenticate against another cloud IdP.
   2. Can authenticate against local AD with Duo Authentication Proxy.
4. MFA Server Profile
   1. This procedure is outlined in the top URL of this reply.
   2. It needs to be combined with a primary authentication profile.

Thanks,

Tom