Add a Global Protect Portal configuration or edit an existing GlobalProtect Portal configuration.Go on the Network tab and choose Global Protect > Portals menu.Configure the Global Protect Portal to use inWebo MFA Typical setup enforce a login and password authentication on the GP Portal and inWebo MFA authentication on the GP Gateway. If you choose to setup inWebo MFA for both Portal and Gateway then users will have to do MFA for both. You may want to use MFA to control access to the GP Portal and/or the GP Gateway. The user will connect using an OTP generated by an inWebo token or by receiving a push notification on his mobile. inWebo doesn't know which LDAP user group your users are member of. Notice : if your policies uses LDAP user groups you'll need to keep an LDAP authentication to retrieve the user group membership. In the 'Advanced' tab make sure you allow your users to use this Authentication profile. Leave the 'Factors' tab default configuration. Within the Device tab click on the Authentication Profile menuĬlick 'Add', change the type to 'RADIUS' then choose the Server Profile previously configured. The Authentication Protocol must be set to PAP You can check our guide Redundancy and RADIUS-client configuration for best practice. Make sure the 'Timeout' and 'Retries' values suits you needs. Go to the Device tab, then choose Server Profiles > RADIUSĬlick Add and declare the inWebo RADIUS pair you want to use. Please let me know if you need more info, and I can have my network engineer post here as well.This guide has been documented for integration on Palo Alto PAN-OS® 8.0. So, our current goal is to use Duo MFA directly with Clearpass (via an API ?) to place users coming in via the Palo VPN into a particular VLAN.ĪNY assistance (guides, links, etc) is most sincerely appreciated. The consultant looked at getting the Duo working directly with Clearpass instead of the Palo, but so far no joy. The problem is that the Duo proxy server only talks MS CHAP v2 and the Palo only talks CHAP. Right now, we have all of this 'almost working' but with a Duo proxy server (some sort of RADIUS server?). Our goal was 'simple' - have a user log into the Palo Alto Global Protect VPN, confirm auth with DUO MFA, and then pass Clearpass OnGuard posting checking, before finally being placed into one of a handful of authorized VLANs (based on security groups in AD). I only have one full time network/security engineer, so we hired a consulting company to help us with integating: Unfortunately for me, my current job as an IT Director probably rests on nailing a major project deliverable within the next ~5-7 business days.

Palo alto globalprotect mfa