Captive Portal Authentication using DUO

This document is designed to help firewall administrators to configure captive Authentication along with Two Factor authentication using DUO authentication.

• PAN OS V8.1+
• DUO MFA.

1. Configure Multi Factor Authentication Server Profile under Device > Server Profiles, this profile defines how firewalls will connect and communicate with MFA providers. In our case we use DUO, so it requires us to get the API Host, Integration Key, and Secret key from DUO protected Application.

1. Download the certificate(s) and import it in the firewall certificate tab as below:

2. Create a certificate profile and add the CA root Certificate(s) as needed, then use this profile in the Multi-Factor Authentication Server profile.

2. Create an Authentication Profile that will be used to authenticate captive portal users, in this profile we will add two authentication steps, the first authentication will be usual authentication using either Local, RADIUS, LDAP or any other type of authentication, in this example we used local authentication.

3. Create Authentication Enforcement object which specifies the method and service to be used for authenticating end users who access your network resources

4. Under Authentication Policy create a rule that match the traffic to invoke the authentication method and service and apply the authentication enforcement as below:

5. Generate a traffic that matches the rule in the authentication Policy, the firewall then redirect the use to the captive portal web page, the user needs to enter his credentials for the first authentication as below:
   1. Generate traffic that matches the rule in the authentication

2. Then the firewall will request the MFA vendor to authenticate the user using the configured procedure like OTP or Automatic Push on the DUO Mobile App. 

3. Once the user passes the second authentication then the user will be allowed to access the intended resource.

6. To Monitor the authentication results, you can go to Monitor > Authentication to check the first and second authentication trial results, the subtype tab will define the authentication type used.