Protecting Admin UI with Duo MFA

[RobBoydCFCU]

I'm attempting to setup Duo MFA with the admin UI of a PA-3220 running PAN-OS 10.2, but have been unsuccessful. I've found that the guide, https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/authentication/configure-multi-factor-aut... is referencing the Duo Access Gateway which is being sunset; new Duo applications using a DAG can no longer be created. Is there any guidance available that includes setting up MFA with PAN-OS 10.2 with Duo SSO?

[Raido_Rattameister]

Config should not be any different on firewall side.

If DUO part is unclear then set up DAG profile style and then clone it to new hosted SAML profile.

[RobBoydCFCU]

I have an existing DAG profile style application in Duo that I converted to a SAML profile and attempted to use that without success. The firewall side was setup pretty much as described in the current guide.

I'll post a screenshot of a failed logon attempt when I can have someone test this configuration again.

[Raido_Rattameister]

Did you download xml config file from new SAML profile in DUO, imported it into Palo  "SAML Identify Provider" and changed auth to use this new profile?

[RobBoydCFCU]

Yes.