Set Up RADIUS or TACACS+ Authentication
RADIUS is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service. TACACS+ is a well-established authentication protocol, common to UNIX networks, that allows a remote access server to forward a user's login password to an authentication server to determine whether access can be allowed to a given system.
a server profile.The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.
- Select DeviceServer Profiles, and then select the profile type (RADIUS or TACACS+).
- Add a new RADIUS or TACACS+ server profile.
- Enter a Profile Name, such as GP-User-Auth.
- If this profile is for a firewall with multiple virtual systems capability, select a virtual system or Shared as the Location where the profile is available.
- Configure the following Server Settings:
- Timeout (sec)—The number of seconds before a server connection request times out due to lack of response from the authentication server.
- Authentication Protocol—The protocol used to connect to the authentication server. Options include CHAP, PAP, PEAP-MSCHAPv2, PEAP with GTC, or EAP-TTLS with PAP.If you configure PEAP-MSCHAPv2 (Protected Extensible Authentication Protocol Microsoft Challenge Handshakie Authentication Protocol version 2) as the authentication protocol, remote users can change their RADIUS or Active Directory (AD) passwords through the GlobalProtect app when their password expires or a RADIUS/AD administrator requires a password change at the next login.
- (RADIUS Only) Retries—The number of times the firewall attempts to connect to the authentication server before dropping the request.
- (TACACS+ only) Use single connection for all authentication—Option that allows all TACACS+ authentication requests to occur over a single TCP session rather than separate sessions for each request.
- Click Add in the Servers area,
and then enter the following information for connecting to the authentication
- RADIUS or TACACS+Server (IP address or FQDN of the server)
- Secret (shared secret that enables the authentication service to authenticate the firewall)
- Click OK to save the server profile.
- (Optional) Create an authentication profile.The authentication profile specifies the server profile that the portal or gateways use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more client authentication profiles. For information on how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.
- Select DeviceAuthentication Profile, and then Add a new profile.
- Enter a Name for the profile.
- Select the AuthenticationType (RADIUS or TACACS+).
- Select the RADIUS or TACACS+ authentication Server Profile that you created in step 1 from the drop-down.
- (RADIUS only) Enable Retrieve user group from RADIUS if you want to include this information in the authentication profile.
- Specify the User Domain and Username
Modifier. The endpoint combines these values to modify
the domain/username string that a user enters during login. The
endpoint uses the modified string for authentication and the User
Domain value for User-ID group mapping. Modifying user
inputs is useful when the authentication service requires domain/username
strings in a particular format and but you do not want to rely on
users entering the domain correctly. You can select from the following
If the Username Modifier includes the %USERDOMAIN% variable, the User Domain value replaces any domain string that the user enters. If the User Domain is blank, the device removes any user-entered domain string.
- To send the unmodified user input, leave the User Domain blank (the default) and set the Username Modifier to the variable %USERINPUT% (the default).
- To prepend a domain to the user input, enter a User Domain and set the Username Modifier to %USERDOMAIN%\%USERINPUT%.
- To append a domain to the user input, enter a User Domain and set the Username Modifier to %USERINPUT%@%USERDOMAIN%.
- On the Advanced tab, Add an Allow List to select the users and user groups that are allowed to authenticate with this profile. The all option allows every user to authenticate with this profile. By default, the list has no entries, which means no users can authenticate.
- Click OK.
- Commit the configuration.
Configure an Authentication Profile
Authentication Profile Device > Authentication Profile Select Device Authentication Profile or Panorama Authentication Profile to manage authentication profiles. To create a new profile, Add one ...
Set Up Kerberos Authentication
Set Up Kerberos Authentication Kerberos is a computer network authentication protocol that uses tickets to allow nodes that communicate over a non-secure network to prove ...
Configure RADIUS Authentication
Configure RADIUS Authentication You can configure RADIUS authentication for end users and firewall or Panorama administrators. For administrators, you can use RADIUS to manage authorization ...
Test Authentication Server Connectivity
Test Authentication Server Connectivity The test authentication feature enables you to verify whether the firewall or Panorama can communicate with the authentication server specified in ...
Set Up LDAP Authentication
Set Up LDAP Authentication LDAP is often used by organizations as an authentication service and a central repository for user information. It can also be ...
Configure RADIUS Authentication for Panorama Administrators
Configure RADIUS Authentication for Panorama Administrators You can use a RADIUS server to authenticate administrative access to the Panorama web interface. You can also define ...
Device > Server Profiles > RADIUS
Device > Server Profiles > RADIUS Select Device Server Profiles RADIUS or Panorama Server Profiles RADIUS to configure settings for the Remote Authentication Dial-In User ...
Configure Local or External Authentication for Firewall Adm...
Configure Local or External Authentication for Firewall Administrators You can use Local Authentication and External Authentication Services to authenticate administrators who access the firewall. These ...
Enable Two-Factor Authentication Using One-Time Passwords (...
Enable Two-Factor Authentication Using One-Time Passwords (OTPs) Use this workflow to configure two-factor authentication using one-time passwords (OTPs) on the portal and gateways. When a ...