Cisco DUO MFA with Radius under Global Protect

cancel
Showing results for 
Search instead for 
Did you mean: 

Cisco DUO MFA with Radius under Global Protect

L3 Networker

Hi Folks,

 

We are trying to configure MFA under Radius using Cisco DUO.

We have done the configuration for MFA in firewall for the same.

Now we are facing some problem such as 'Reason: Invalid username/password. auth profile \'Duo_Auth\', vsys \'vsys1\', server profile \'Duo_Radius\', server address Failed to communicate with any Active Directory server\' From: x.x.x.x'

This is the error coming in system log.

Also when we tried to login with CLI using test authentication authentication-profile auth-profile username & passwork.

We received this below error message.

Target vsys is not specified, user "username" is assumed to be configured with a shared auth profile.

Do allow list check before sending out authentication request...
name "username" is in group "all"

Egress: No service source route is set, might use destination source route if configured
Authentication to RADIUS server at x.x.x.x:1812 for user "Username"
Authentication type: PAP
Now send request to remote server ...
Authentication failed against RADIUS server at x.x.x.x:1812 for user "Username"

Authentication failed for user "Username"

 

What could be the cause here let me know what could be done next.

 

Cheers

 

3 REPLIES 3

L4 Transporter

Hi @Vijaygvasan ,

 

You mentioned RADIUS.  Have you configured the Duo Authentication Proxy?  Here is a doc for GP, but the RADIUS config is the same regardless of the use case.  https://duo.com/docs/paloalto

 

Here is an overview of supported use cases and protocols for PANW MFA.  https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table.h...  Note that the MFA server profiles can only be used with the Authentication Policy for now.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

Could you please share any methods or documents to use Authentication policy using MFA.

Or some steps would be fine for that.

 

Cheers

L4 Transporter

Hi @Vijaygvasan ,

 

Sure!  Here is a doc -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HANzCAO&lang=en_US%E2%80%A....  That doc uses an MFA server profile.

 

With PANW and Duo, there are 4 ways to configure MFA:

 

  1. RADIUS with Duo Authentication Proxy (free install from Duo on Windows server).
    1. The RADIUS server profile configured in the GP doc in the previous reply can also be applied to Auth Policy.
  2. SAML with Duo Access Gateway (another free install on Windows).
    1. Here is a doc -> https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/authentication/configure-multi-factor-aut....
    2. The SAML server profile configured in this doc can also be applied to Auth Policy
  3. SAML with Duo SSO.
    1. Can authenticate against another cloud IdP.
    2. Can authenticate against local AD with Duo Authentication Proxy.
  4. MFA Server Profile
    1. This procedure is outlined in the top URL of this reply.
    2. It needs to be combined with a primary authentication profile.

Thanks,

 

Tom

 

Help the community: Like helpful comments and mark solutions.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!