Palo Alto NGFW: LDAP authentication with DUO/OKTA MFA

[jeromej]

Hi,

We have a got a new Palo Alto NGFW in our Premises and configured with LDAP for authentication. Things were good with LDAP for authentication until we started looking for MFA. I couldn't find any document to have LDAP and DUO/OKTA for MFA. As this is my first firewall configuration, it hits me so hard. Can someone help me with this?

Thanks,

Jerome J

[TomYoung · Accepted solution]

Hi @jeromej ,

Both Duo and Okta support GlobalProtect through either RADIUS or SAML.

1. RADIUS would be easier, in my opinion.  It uses the Duo Authentication Proxy (DAP) or the Okta RADIUS Agent.  These services authenticate to AD.
2. SAML will go direct to the Duo or Okta cloud.  It will need to be connected to AD somehow.

Here is a simple diagram -> https://www.okta.com/integrations/mfa-for-vpn/palo-alto-networks/.

From experience the DAP is easy to setup and troubleshoot once you get used to it.  I have never done Okta.

You would think that you could use the Factors tab in the Authentication Profile.  Unless this table is old -> https://docs.paloaltonetworks.com/compatibility-matrix/mfa-vendor-support/mfa-vendor-support-table that method is only supported for Authentication Proxy.

You can Google "globalprotect duo" or "globalprotect okta" and you will find clear docs on how to do it from Duo/Okta/PANW using RADIUS or SAML.

Thanks,

Tom

[jeromej]

Hi @TomYoung,

Thanks for the reply. I have got a better view on this now. 

I would like to go with Okta RADIUS, as our organization prefers Okta over DUO for some reasons. So will work on the Okta RADIUS integration with PA.

Thanks,

Jerome