GlobalProtect VPN Enforcing Password Changes and Google Authenticator MFA

[GWong4]

I have two inquiries regarding GlobalProtect VPN:

1. Password Change: Is there a feature that mandates users to change their GlobalProtect VPN password after their initial login?

2. MFA Support: Does GlobalProtect VPN support Multi-Factor Authentication (MFA) using Google Authenticator?"

Best Regards

[JayGolf · Accepted solution]

Hi @GWong4 ,

Changing your password upon first logon while connecting to GP and using local user database auth is not natively supported, but you can enforce it using other auth methods like ldap, radius, and saml. For example, user signs into GP that initiates a saml auth request to your IdP of choice. An embedded browser pops-up to sign into your sso service url and your IdP forces users to change their password. Once completed, the IdP sends a saml response back to GP, allowing access. **This can work with radius/ldap server as well. You can also throw in Google Authenticator into the mix through radius or saml. 

Are you looking to deploy GlobalProtect for the first time? Do you have an idea of how you want to handle authentication? 

Happy to help! 

[GWong4]

Hi jayGolf,

Thanks for the explanation is because the GP is mainly for external vendor use. Hence I think it is better isolated the external vendor login via firewall features itself. 

Anyway thanks for the explanation