How To: Prevent Double Authentication With Palo Alto GlobalProtect and RADIUS – SecureAuth Support

Version Affected: All

Overview

This article explains how to prevent GlobalProtect from prompting for authentication a second time when integrating Palo Alto GlobalProtect with RADIUS. Without this configuration, the client prompts for authentication twice when connecting -- once for the SecureAuth RADIUS realm, and again for GlobalProtect itself -- because of how GlobalProtect's own portal-to-gateway handoff works.

Configure a Single Prompt for GlobalProtect and RADIUS

In the Palo Alto VPN admin console:

Select Portal > Agent > Authentication and the relevant profile.
Check Generate cookie for authentication override.
Under Components that Require Dynamic Passwords (Two-Factor Authentication), enable the external gateways option.

The Palo Alto Portal Agent Authentication profile, with Generate cookie for authentication override checked and a certificate selected to encrypt/decrypt the cookie.

Select Gateway > Agent > Client Settings.
Check Accept cookie for authentication override.

The Palo Alto Gateway Client Settings profile, with Accept cookie for authentication override checked.

Both the Portal and Gateway profiles must use the same certificate to encrypt and decrypt the cookie -- this should be the same certificate already used as the SAML certificate on the IdP realm.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.