{"id":751,"date":"2020-07-23T16:19:24","date_gmt":"2020-07-23T08:19:24","guid":{"rendered":"https:\/\/www.insecurewire.com\/?p=751"},"modified":"2020-07-23T16:19:24","modified_gmt":"2020-07-23T08:19:24","slug":"configuring-duo-two-factor-authentication-with-palo-alto-globalprotect","status":"publish","type":"post","link":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/","title":{"rendered":"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect"},"content":{"rendered":"

During the COVID-19 lockdown I was asked to setup a VPN and secure it with two factor authentication. Below I detail the steps to configure DUO with Palo Alto GlobalProtect.<\/p>\n

There is a couple of assumptions here. You have experience with PAN OS and have setup Palo Alto GlobalProtect. The Palo Alto deployment method is Global Protect client based IPSec VPN with SSL fallback. For DUO we are going to use RADIUS deployment method with the DUO Proxy.<\/p>\n

More information on the deployment methods of DUO can be found here<\/a><\/p>\n

Duo Proxy Configuration<\/strong>
\nStep 1.
\nSelect Applications menu option in your DUO admin panel tenancy. Select protect an application and Palo Alto SSL VPN. Make a note of your integration and secret keys. These are used to configure the Duo proxy.
\nStep 2.
\nConfigure a local Windows VM on your windows domain. Install the DUO Proxy from here<\/a>. It is a standard setup file. Once installed you need to configure the proxy by editing the authproxy.cfg file in C:\\Program Files (x86)\\Duo Security Authentication Proxy\\conf\\
\n[main]\ninterface = x.x.x.x
\n[ad_client]\nhost = 192.168.1.1
\nsearch_dn = DC=contoso,DC=com
\nservice_account_username = ldap
\nservice_account_password = secretpassword
\n[radius_server_auto]\nikey = yourikeyhere
\nskey = yourskeyhere
\napi_host = api-xxxxxxxx.duosecurity.com
\nradius_ip_1 = 192.168.1.254
\nradius_secret_1 = myradiussecret
\nport = 1812
\nclient = ad_client
\nclient_ip_attr = paloalto
\n<\/code><\/p>\n

OK so in this example we are pointing the DUO Proxy to the PA firewall interface 192.168.1.254 as the radius authenticator. I also configure the interface IP of the server to bind to. This is handy for servers that have multiple nics. Substitute your secrets such as ikey \/ skey and the ip addresses as per above. Once configured, save the file and start the service from services.msc. Note that the service will not start if there is a misconfiguration in the config file. It is also cool that you can bind the DUO Proxy to any port. I am using 1812, however if your sever had Microsoft NPS on it already using 1812, you can use a non standard port for RADIUS such as 1810.<\/p>\n

Palo Alto Configuration<\/strong>
\nStep 1.
\nConfigure the PA to point to the DUO Proxy. Essentially the DUO Proxy is a RADIUS server:
\nDevice > Server Profiles > RADIUS
\nSet IP of DUO Proxy and Port.
\n\"Radius<\/a>
\nStep 2.
\nConfigure Authentication Profile.
\nDevice > Authentication Profile:
\nSet Server Profile to the previous created RADIUS profile. Set User Domain to your Active Directory short hand domain name. This means users wont have to type the domain name on the Global Protect client login (only the username).
\n\"Authentication<\/a>
\nStep 3.
\nConfigure GlobalProtect Gateway.
\nNetwork > GlobalProtect > Gateways > edit gateway and select Authentication tab. Set the authentication profile to be the one we just configured in step 4.
\nStep 4 (Optional).
\nContinuing with GlobalProtect Gateway settings:
\nClick the Agent tab on the left and then click the Client Settings tab. Click on the name of your config to open it.
\nClick on Authentication Override. Tick generate cookie and accept cookie and set the lifetime. You will need to select a valid certificate for authentication cookie Encrypt and Decrypt. This will make it so once the user passes both GlobalProtect and DUO authentication they wont have to re-authenticate during this time period. For example if the deployment is for work from home and the user gets disconnected due to home broadband drop out, once reconnected during the cookie window user wont be asked for authentication.
\n\"Cookie<\/a>
\nStep 5.
\nUnder Gateway > Agent > Tunnel Settings. Be sure to tick “Enable IPSec”. The PA will try to negotiate IPSec first, if it cant it will fall back to TLS (SSL). You can also set the IPSec Crypto policy to use more secure method here such as AES-256-GCM.
\n\"IPSec\"<\/a>
\nClick OK twice and save \/ commit all of the settings.<\/p>\n","protected":false},"excerpt":{"rendered":"

During the COVID-19 lockdown I was asked to setup a VPN and secure it with two factor authentication. Below I detail the steps to configure…<\/p>\n","protected":false},"author":2,"featured_media":804,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35,5],"tags":[],"class_list":["post-751","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-multi-factor-authentication","category-palo-alto-networks"],"acf":[],"yoast_head":"\nConfiguring Duo Two Factor Authentication with Palo Alto GlobalProtect - Insecure Wire<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect - Insecure Wire\" \/>\n<meta property=\"og:description\" content=\"During the COVID-19 lockdown I was asked to setup a VPN and secure it with two factor authentication. Below I detail the steps to configure...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\" \/>\n<meta property=\"og:site_name\" content=\"Insecure Wire\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-23T08:19:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png\" \/>\n\t<meta property=\"og:image:width\" content=\"396\" \/>\n\t<meta property=\"og:image:height\" content=\"127\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"nikonau\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/insecurewire\" \/>\n<meta name=\"twitter:site\" content=\"@insecurewire\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"nikonau\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\"},\"author\":{\"name\":\"nikonau\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\"},\"headline\":\"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect\",\"datePublished\":\"2020-07-23T08:19:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\"},\"wordCount\":584,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png\",\"articleSection\":[\"Multi Factor Authentication\",\"Palo Alto Networks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\",\"url\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\",\"name\":\"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect - Insecure Wire\",\"isPartOf\":{\"@id\":\"https:\/\/www.insecurewi.re\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png\",\"datePublished\":\"2020-07-23T08:19:24+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png\",\"width\":396,\"height\":127,\"caption\":\"DUO\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.insecurewi.re\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.insecurewi.re\/#website\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"name\":\"Insecure Wire\",\"description\":\"A Network Engineer\u2019s Perspective.\",\"publisher\":{\"@id\":\"https:\/\/www.insecurewi.re\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.insecurewi.re\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.insecurewi.re\/#organization\",\"name\":\"Insecure Wire\",\"url\":\"https:\/\/www.insecurewi.re\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"contentUrl\":\"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png\",\"width\":32,\"height\":32,\"caption\":\"Insecure Wire\"},\"image\":{\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/insecurewire\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d\",\"name\":\"nikonau\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g\",\"caption\":\"nikonau\"},\"sameAs\":[\"https:\/\/x.com\/https:\/\/twitter.com\/insecurewire\"],\"url\":\"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect - Insecure Wire","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/","og_locale":"en_US","og_type":"article","og_title":"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect - Insecure Wire","og_description":"During the COVID-19 lockdown I was asked to setup a VPN and secure it with two factor authentication. Below I detail the steps to configure...","og_url":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/","og_site_name":"Insecure Wire","article_published_time":"2020-07-23T08:19:24+00:00","og_image":[{"width":396,"height":127,"url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png","type":"image\/png"}],"author":"nikonau","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/insecurewire","twitter_site":"@insecurewire","twitter_misc":{"Written by":"nikonau","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#article","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/"},"author":{"name":"nikonau","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d"},"headline":"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect","datePublished":"2020-07-23T08:19:24+00:00","mainEntityOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/"},"wordCount":584,"commentCount":0,"publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png","articleSection":["Multi Factor Authentication","Palo Alto Networks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/","url":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/","name":"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect - Insecure Wire","isPartOf":{"@id":"https:\/\/www.insecurewi.re\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage"},"image":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage"},"thumbnailUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png","datePublished":"2020-07-23T08:19:24+00:00","breadcrumb":{"@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#primaryimage","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2020\/07\/download.png","width":396,"height":127,"caption":"DUO"},{"@type":"BreadcrumbList","@id":"https:\/\/www.insecurewi.re\/index.php\/2020\/07\/23\/configuring-duo-two-factor-authentication-with-palo-alto-globalprotect\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.insecurewi.re\/"},{"@type":"ListItem","position":2,"name":"Configuring Duo Two Factor Authentication with Palo Alto GlobalProtect"}]},{"@type":"WebSite","@id":"https:\/\/www.insecurewi.re\/#website","url":"https:\/\/www.insecurewi.re\/","name":"Insecure Wire","description":"A Network Engineer\u2019s Perspective.","publisher":{"@id":"https:\/\/www.insecurewi.re\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.insecurewi.re\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.insecurewi.re\/#organization","name":"Insecure Wire","url":"https:\/\/www.insecurewi.re\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/","url":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","contentUrl":"https:\/\/www.insecurewi.re\/wp-content\/uploads\/2023\/10\/cloud.png","width":32,"height":32,"caption":"Insecure Wire"},"image":{"@id":"https:\/\/www.insecurewi.re\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/insecurewire"]},{"@type":"Person","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/8ba08b41fc754b971a948ead6ccb777d","name":"nikonau","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.insecurewi.re\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2d1b9d9dc90da4f6d3da31b870f418c6b3553ba9be48d53e8ee3a35b0adb1d35?s=96&d=mm&r=g","caption":"nikonau"},"sameAs":["https:\/\/x.com\/https:\/\/twitter.com\/insecurewire"],"url":"https:\/\/www.insecurewi.re\/index.php\/author\/nikon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/751","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/comments?post=751"}],"version-history":[{"count":0,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/posts\/751\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media\/804"}],"wp:attachment":[{"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/media?parent=751"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/categories?post=751"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insecurewi.re\/index.php\/wp-json\/wp\/v2\/tags?post=751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}