topic Re: Two factor authentication for Palo alto VPN users using ISE in Network Access Control

Two factor authentication for Palo alto VPN users using ISE

sming.ib.96 — Thu, 21 Jul 2022 11:06:05 GMT

Can i get any reference documents or link to implement Two factor authentication for Palo alto VPN users using ISE ?

Re: Two factor authentication for Palo alto VPN users using ISE

ahollifield — Thu, 21 Jul 2022 17:31:08 GMT

This is a Cisco forum, I don't think you'll find much help here for configuring the Palo Alto side. ISE isn't an MFA provider. Have a look at DUO: https://duo.com/

There are plenty of integrations you can do between ISE and DUO.

Re: Two factor authentication for Palo alto VPN users using ISE

wilkins_95 — Wed, 13 Mar 2024 20:51:35 GMT

Did you ever find a solution for this? I also was questioning if I can leverage ISE to use as a MFA solution for our Palo GlobalProtect login

Re: Two factor authentication for Palo alto VPN users using ISE

Pulkit Mittal — Thu, 14 Mar 2024 04:21:50 GMT

You can use Cisco ISE as Radius to authenticate users in Palo firewalls.

Configuring Palo Alto Administrator Authentication with Cisco ISE (packetswitch.co.uk)

Basically, then you can leverage ISE authentication rules to have Duo as an external radius server for mfa.

Duo Two-Factor RADIUS Authentication for Cisco ISE | Duo Security

Regards,

Pulkit

If you find this useful, please mark it helpful and accept the solution.

Two factor authentication for Palo alto VPN users using ISE

wilkins_95 — Thu, 14 Mar 2024 11:30:37 GMT

Hello Pulkit

I'm specially talking about GlobalProtect (client-less vpn). I'll explain, we allow users access to inside resources from outside our building via GlobalProtect. So let's say I'm home, I browse to [ https://example.globalprotect.com,/ | https://example.globalprotect.com, ] I hit the GlobalProtect login screen. We leverage logins with our LDAP server, so I enter my LDAP credentials and I'm in. That's the current footprint. What I want to do now is add MFA, same process but I want the user to now also be prompted for a verification code, that would be sent to his/her e-mail. I'm looking for the most simplistic way to accomplish this and had loosely read via other blogs that that Cisco ISE (which we also have) may be able to provide this via it's RADIUS feature. Is this true?

Re: Two factor authentication for Palo alto VPN users using ISE

Pulkit Mittal — Thu, 14 Mar 2024 11:40:55 GMT

That is a specific guest portal authentication mechanism which is not at all applicable in this case.

What you are after will require a 2FA mechanism and ISE is not the right product for that purpose. It can best work in conjunction to mfa solution like Duo.

Re: Two factor authentication for Palo alto VPN users using ISE

Pulkit Mittal — Thu, 14 Mar 2024 11:42:13 GMT

Like I mentioned, similar to this use case.

https://community.cisco.com/t5/network-access-control/cisco-anyconnect-two-factor-authentication-with-cisco-ise-ad-one/td-p/3325240