GlobalProtect FIDO2 Support and Browser Issues

[Y.Tsushima]

Hello everyone,

Could you tell me about the following?

1. Is FIDO2 authentication supported by Global Protect?

*According to the following website, it appears to be supported.

https://docs.paloaltonetworks.com/whats-new/new-features/june-2024/gp-webview2-63

2. If FIDO2 authentication by Global Protect is supported, what versions of the Global Protect client and PAN-OS support FIDO2 authentication?

3. According to the article below, it seems that there is a problem with FIDO2 authentication only in the built-in browser, but will it work normally in other browsers regardless of version?

https://live.paloaltonetworks.com/t5/globalprotect-discussions/fido2-support-for-globalprotect-clien...

[reaper]

1. yes but id' probably recommend going with GlobalProtect 6.3

2. 6.2 appears to work as seen in the forum post you linked in 3. . I would aim or GP 6.3 as that has documented support

3. for FIDO2 the usual recommendation is to use the system browser which will always* support FIDO2

*unless your system browser's security has been set so thight it is unable to interface with the smartkey/smartcard/...

[Y.Tsushima]

Hello Reaper-san,

My understanding is as follows. Could you please point out any errors?

1. FIDO2 authentication via Global Protect is supported.

2. The version of the Global Protect client that supports FIDO2 authentication is 6.3.

3. No issues with FIDO2 authentication have been reported with browsers other than the built-in browser.

It is recommended to use a browser that supports FIDO2.

Just to confirm, what version of PAN-OS supports FIDO2 authentication via Global Protect?

Regards,

Yusuke Tsushima

[reaper · Accepted solution]

Hello Tsushima-san

1. This is correct

2. This is also correct

3. Also correct. Most system browsers support FIDO2 with no extra effort. the GlobalProtect embedded browser did not support FIDO2 until recently

4. the PAN-OS version does not matter, FIDO2 happens at the client side. For the firewall this is 'normal' SAML authentication

Best regards

Tom

[Y.Tsushima]

Hello Tom-san,

Thank you.

1.~3. I understand that my understanding is correct.

4. I understand that FIDO2 authentication is available regardless of the PAN-OS version.

Regards,

Yusuke Tsushima