Focus

GlobalProtect

Enable Delivery of VSAs to a RADIUS Server

Table of Contents

Filter

Expand All | Collapse All

GlobalProtect Docs

Administration
Version
- 10.1 & Later
- 9.1 (EoL)
User Guide
Version
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
New Feature
Version
- 6.1
- 6.0
- 5.1
Release Notes
Version
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1

Configure GlobalProtect to Facilitate Multi-Factor Authentication Notifications

Enable Group Mapping

Enable Delivery of VSAs to a RADIUS Server

Enable the GlobalProtect portal or gateway to send Vendor-Specific Attributes (VSAs) to a RADIUS server during authentication, allowing RADIUS administrators to perform administrative tasks based on those attributes.

When communicating with portals or gateways, GlobalProtect endpoints send information that includes the endpoint IP address, operating system (OS), hostname, user domain, and GlobalProtect app version. You can enable the firewall to send this information as Vendor-Specific Attributes (VSAs) to a RADIUS server during authentication (by default, the firewall does not send the VSAs). RADIUS administrators can then perform administrative tasks based on those VSAs. For example, RADIUS administrators might use the OS attribute to define a policy that mandates regular password authentication for Microsoft Windows users and one-time password (OTP) authentication for Google Android users.

The following are prerequisites for this procedure:

Import the Palo Alto Networks RADIUS dictionary into your RADIUS server.
Configure a RADIUS server profile and assign it to an authentication profile. See Set Up External Authentication for more details.
Assign the authentication profile to a GlobalProtect portal or gateway. See Set Up Access to the GlobalProtect Portal or Configure a GlobalProtect Gateway for more details.

Enter the command for each VSA you want to send:

username@hostname> set authentication radius-vsa-on client-source-ip 
username@hostname> set authentication radius-vsa-on client-os 
username@hostname> set authentication radius-vsa-on client-hostname 
username@hostname> set authentication radius-vsa-on user-domain 
username@hostname> set authentication radius-vsa-on client-gp-version

If you later want to stop the firewall from sending particular VSAs, run the same commands but use the radius-vsa-off option instead of radius-vsa-on.

Configure GlobalProtect to Facilitate Multi-Factor Authentication Notifications

Enable Group Mapping

GlobalProtect Docs

Enable Delivery of VSAs to a RADIUS Server

GlobalProtect Docs

Enable Delivery of VSAs to a RADIUS Server

Next-Generation Firewalls

SASE

Cloud-Delivered Security Services

Experts Corner