Step 5. Navigate back to Panorama under Device > Mobile User's Template > Server Profiles > SAML Identity Provider and Select "Import" on the bottom left

• Browse and import the metadata file
• To simplify the process, we will unselect "Validate Identity Provider Certificate"
• Select OK

Note: This should automatically import the necessary IDP certificates and create the SAML IDP configuration

Step 6. Next Navigate to Device > Mobile User's Template > Authentication Profile

• Select Add and Configure the following
  • Type: SAML
  • IdP Server Profile: <Your SAML IDP Server Profile created in Step 5>

• We will leave the rest blank for the purpose of this doc

Step 7. Navigate to the Advanced Tab and Specify all in the Allow List

• Select OK and Commit to Panorama

-----------------------------------------------------------------------------------------------------------------------

Configuring the Captive Portal

Now that we have pre-staged our authentication method, we will move forward with the Captive Portal configuration

• Select the Gear Icon and Specify
  • SSL/TLS Profile: <Profile the CP will use for TLS communication>
  • Authentication Profile: <The Auth Profile CP will use>
  • Mode: Redirect
  • Redirect Host: Specify your Service Infrastructure Captive Portal IP or resolvable FQDN where the Firewall will redirect the user to

• Select Okay and commit to Panorama

 

Authentication Policies and Objects

Step 1. Configure the Authentication Object

• Navigate to Objects > Mobile User's Device Group > Authentication then Select Add and Specify:
  • Authentication Method: web-form
  • Authentication Profile: <SAML Authentication Profile>

• Select OK when done

------------------------------------------------------------------------------------------------------------------------

Test the Setup

For this example, I am testing accessing another FW connected to a service connection within my MU's Region







--------------------------------------------------------------------------------------------------------------------------------------
 

Captive Portal for Non-HTTP/HTTPS Applications

MFA Prompt Consideration with Windows

• For non-https applications to achieve the goal of authentication GP will forward an MFA prompt using UDP on port 4501 from the Connected Gateway Tunnel IP
• Please ensure Windows Firewall's are disabled or allow this inbound connection for MFA pop-up

• Select OK when done and apply the settings

Configuration

Note: Please reference the previous configuration sections to Setup CP, Authentication Profiles and Authentication Policies and Objects if only configuring non-HTTPS apps

 

Step 1. Create a Captive Portal Policy for the service that needs restriction, for this example we'll be testing SSH



Step 2. Navigate to the network tab > Portals and select your GP Portal



Step 3. Next Navigate to Agent Tab > (your agent-config) > App Tab
Change the following:

• Enable Inbound Authentication prompts from MFA Gateways: Set to Yes
• Trusted MFA gateways: Specify your Captive Portal IP/FQDN along with the CP Port

• Select OK and commit to Panorama
• When ready push to Mobile Users

Step 4. Test the Setup

• SSH to the resource and you should receive a pop-up

 

--------------------------------------------------------------------------------------------------------------------

Caveats

• Authentication Objects

  • Custom Authentication objects are mandatory for SAML SSO redirection
  • Using the default-web form object will not trigger the Captive Portal Redirection to occur when using SAML SSO
  • The default web-form object is intended for authentication where the firewall is handling the credentials, this is not compatible with SAML SSO

• Authentication Policy Timeout

  • With SAML SSO, the authentication re-prompting relies on authentication timestamps
  • A user will not be repromoted to authenticate to a resource until the timeout timeframe in the matched policy has elapsed
  • It is important to note once a user has authenticated once, all policies with the same authentication method will not trigger unless the timestamp exceeds that policies timeout value.
  • For example
    • Policy A has timeout of 1 hour
    • Policy B has timeout of 8 hours
    • If the user triggers Policy B, the authentication timestamp will be logged and the user will be able to access the resources in both policy A and B without reauthentication
    • If after 2 hours the user initiates a new connection to Policy A resource, Captive Portal will trigger as the timeout value has exceeded Policy A's value

• Captive Portal Session Cookie

  • Session Cookies are applicable to other forms of authentication where the Firewall is handling the user's credentials such as LDAP with MFA factor
  • This will save a cache entry for the user along with a TTL value for the session cookie timeout
    • Once the TTL hits 0 the firewall will prompt when a user matches the policy
  • The firewall will not create a session cookie for SAML SSO authentications