Global Protect / DUO 2F

[zenithnetworks]

Yesterday, I posted a very detailed message regarding GP / MF.  Let me ask this... maybe to broad of a question...

I integrated PAN GP 2f using DUO and all works great ( I will get to the one exception ).  First factor is LDAP and 2nd factor is radius against an in-house DUO Proxy application ( 1812 ).  Remote user start GP client... enters creds.. ldap auth is good... 2f is radius... this is good.... duo send message to the iphone duo app... select accept and all is fine and the user is successfully connected.  The exception... if DUO is set to actually RING the user.... user receives the DUO call... pick and hit # to accept and at that instant the GP client closes and no connection.  If you see my post from yesterday you will see details.

One very interesting footnote... last night I tested, just to better captured logs and ALL WORKED!!  And I just tested again and all works... strange behavior.

For what I have mentioned here.... has anyone experienced this DUO phone call behavior ???

Thanks... Tom

[Adrian_Jensen]

I have occasionally seen that behavior, where the GP client immediately closes/fails the Gateway connection attempt. Cancelling the connection or (re)selecting a different Portal seems to fix it. You may also want to look at the system logs and see if the DUO radius server sent back a failed result to the authentication report.

[zenithnetworks]

Adrian... Thanks for your reply, much appreciated.  This is a strange, strange problem.  For me, everything works great with DUO auth, for others either DUO does not work at all ( with an actual call ) or all works and then does not.  Firewall logs look great ( authd.log  and GP logs, except when DUO Call fails, the GP logs do not hand out an address from the pool, which is expected when the DUO fails.  But authd logs are grerat... never a problem... all protocol handshake is fine... even when this fails for the user and I am very experienced with troubleshooting raidus / ldap / GP..... but the logs look great.  I can also use multiple different clients and never a problem for me.  Also, this is a new PAN install... I replaced an ASA and prior to the PAN, the customer was using DUO with the callback feature and no problems.  I have a case into PAN PS.  This is very strange.  I wanted the user to help me with a couple of tests.... have them login as me and me as them and observe results, but they could not work with me. I am trying to find the very difficult failure pattern.