using local database of user for GP but adding DUO as 2FA doesn't work

[Jose_Espinoza]

hello team

we are trying to using local database of user for GP but adding DUO as 2FA doesn't work, still is not working we follow the below link from DUO: https://duo.com/docs/paloalto#:~:text=Click%20on%20your%20configured%20GlobalProtect,Profile%22%20se....

we use the SAML option but when we try to authenticate does not work.

I did found anything on PA documentation that specify that 2FA will work with local database of user.

Any Help is appreciate.

cordially

jose

[Jose_Espinoza · Accepted solution]

I  found from DUO web portal the answer> https://help.duo.com/s/article/2322?language=en_US  

"Duo cannot be used to provide two-factor authentication for local users of a Palo Alto GlobalProtect. This is due to a limitation of Palo Alto GlobalProtect -- it does not have a way to perform separate secondary authentication to a RADIUS or LDAP server."

I will mark as solved this question.

thanks