Two factor authentication for Palo alto VPN users using ISE

[sming.ib.96]

Can i get any reference documents or link to implement Two factor authentication for Palo alto VPN users using ISE ?

[ahollifield]

This is a Cisco forum, I don't think you'll find much help here for configuring the Palo Alto side.  ISE isn't an MFA provider.  Have a look at DUO: https://duo.com/  

There are plenty of integrations you can do between ISE and DUO.

[wilkins_95]

Did you ever find a solution for this? I also was questioning if I can leverage ISE to use as a MFA solution for our Palo GlobalProtect login

[Pulkit Mittal]

You can use Cisco ISE as Radius to authenticate users in Palo firewalls. 

Configuring Palo Alto Administrator Authentication with Cisco ISE (packetswitch.co.uk)

Basically, then you can leverage ISE authentication rules to have Duo as an external radius server for mfa.

Duo Two-Factor RADIUS Authentication for Cisco ISE | Duo Security

Regards,

Pulkit

If you find this useful, please mark it helpful and accept the solution.

[wilkins_95]

Hello Pulkit

I'm specially talking about GlobalProtect (client-less vpn). I'll explain, we allow users access to inside resources from outside our building via GlobalProtect. So let's say I'm home, I browse to [ https://example.globalprotect.com,/ | https://example.globalprotect.com, ] I hit the GlobalProtect login screen. We leverage logins with our LDAP server, so I enter my LDAP credentials and I'm in. That's the current footprint. What I want to do now is add MFA, same process but I want the user to now also be prompted for a verification code, that would be sent to his/her e-mail. I'm looking for the most simplistic way to accomplish this and had loosely read via other blogs that that Cisco ISE (which we also have) may be able to provide this via it's RADIUS feature. Is this true?

[Pulkit Mittal]

That is a specific guest portal authentication mechanism which is not at all applicable in this case.

What you are after will require a 2FA mechanism and ISE is not the right product for that purpose. It can best work in conjunction to mfa solution like Duo.

[Pulkit Mittal]

Like I mentioned, similar to this use case.

https://community.cisco.com/t5/network-access-control/cisco-anyconnect-two-factor-authentication-with-cisco-ise-ad-one/td-p/3325240