Set Up RADIUS or TACACS+ Authentication

RADIUS is a client/server protocol and software that enables remote access servers to communicate with a central server to authenticate dial-in users and authorize their access to the requested system or service. TACACS+ is a well-established authentication protocol, common to UNIX networks, that allows a remote access server to forward a user's login password to an authentication server to determine whether access can be allowed to a given system.
  1. Create a server profile.
    The server profile identifies the external authentication service and instructs the firewall how to connect to that authentication service and access the authentication credentials for your users.
    If you want to Enable Delivery of VSAs to a RADIUS Server, you must create a RADIUS server profile.
    1. Select
      Device
      Server Profiles
      , and then select the profile type (
      RADIUS
      or
      TACACS+
      ).
    2. Add
      a new RADIUS or TACACS+ server profile.
    3. Enter a
      Profile Name
      , such as
      GP-User-Auth
      .
    4. If this profile is for a firewall with multiple virtual systems capability, select a virtual system or
      Shared
      as the
      Location
      where the profile is available.
    5. Configure the following
      Server Settings
      :
      • Timeout (sec)
        —The number of seconds before a server connection request times out due to lack of response from the authentication server.
      • Authentication Protocol
        —The protocol used to connect to the authentication server. Options include
        CHAP
        ,
        PAP
        ,
        PEAP-MSCHAPv2
        ,
        PEAP with GTC
        , or
        EAP-TTLS with PAP
        .
        If you configure
        PEAP-MSCHAPv2
        (Protected Extensible Authentication Protocol Microsoft Challenge Handshakie Authentication Protocol version 2) as the authentication protocol, remote users can change their RADIUS or Active Directory (AD) passwords through the GlobalProtect app when their password expires or a RADIUS/AD administrator requires a password change at the next login.
      • (
        RADIUS Only
        )
        Retries
        —The number of times the firewall attempts to connect to the authentication server before dropping the request.
      • (
        TACACS+ only
        )
        Use single connection for all authentication
        —Option that allows all TACACS+ authentication requests to occur over a single TCP session rather than separate sessions for each request.
    6. Click
      Add
      in the
      Servers
      area, and then enter the following information for connecting to the authentication server:
      • Name
      • RADIUS
        or
        TACACS+
        Server
        (IP address or FQDN of the server)
      • Secret
        (shared secret that enables the authentication service to authenticate the firewall)
      • Port
    7. Click
      OK
      to save the server profile.
  2. (
    Optional
    ) Create an authentication profile.
    The authentication profile specifies the server profile that the portal or gateways use when they authenticate users. On a portal or gateway, you can assign one or more authentication profiles in one or more client authentication profiles. For information on how an authentication profile within a client authentication profile supports granular user authentication, see Configure a GlobalProtect Gateway and Set Up Access to the GlobalProtect Portal.
    To enable users to connect and change their own expired passwords without administrative intervention, consider using Remote Access VPN with Pre-Logon.
    1. Select
      Device
      Authentication Profile
      , and then
      Add
      a new profile.
    2. Enter a
      Name
      for the profile.
    3. Select the
      Authentication
      Type
      (
      RADIUS
      or
      TACACS+
      ).
    4. Select the RADIUS or TACACS+ authentication
      Server Profile
      that you created in step 1 from the drop-down.
    5. (
      RADIUS only
      ) Enable
      Retrieve user group from RADIUS
      if you want to include this information in the authentication profile.
    6. Specify the
      User Domain
      and
      Username Modifier
      . The endpoint combines these values to modify the domain/username string that a user enters during login. The endpoint uses the modified string for authentication and the
      User Domain
      value for User-ID group mapping. Modifying user inputs is useful when the authentication service requires domain/username strings in a particular format and but you do not want to rely on users entering the domain correctly. You can select from the following options:
      • To send the unmodified user input, leave the
        User Domain
        blank (the default) and set the
        Username Modifier
        to the variable
        %USERINPUT%
        (the default).
      • To prepend a domain to the user input, enter a
        User Domain
        and set the
        Username Modifier
        to
        %USERDOMAIN%\%USERINPUT%
        .
      • To append a domain to the user input, enter a
        User Domain
        and set the
        Username Modifier
        to
        %USERINPUT%@%USERDOMAIN%
        .
      If the
      Username Modifier
      includes the
      %USERDOMAIN%
      variable, the
      User Domain
      value replaces any domain string that the user enters. If the
      User Domain
      is blank, the device removes any user-entered domain string.
    7. On the
      Advanced
      tab,
      Add
      an
      Allow List
      to select the users and user groups that are allowed to authenticate with this profile. The
      all
      option allows every user to authenticate with this profile. By default, the list has no entries, which means no users can authenticate.
    8. Click
      OK
      .
  3. Commit
    the configuration.

Related Documentation