Rublon

Secure Remote Access

By

Last updated on July 1, 2026

Overview of MFA for Palo Alto GlobalProtect

Multi-Factor Authentication (MFA) for Palo Alto GlobalProtect is an additional security measure that requires users to provide two authentication factors to gain access to the VPN. The first factor requires users to enter their Active Directory / RADIUS username and password. Once completed, the user undergoes a secondary authentication process using a supported authentication method such as a Mobile Push or Email Link. After the user completes both steps of authentication, they will be granted access. Enabling MFA for Palo Alto GlobalProtect offers enhanced security and prevents malicious actors from using stolen credentials to gain access to resources.

Rublon introduces Multi-Factor Authentication in a number of ways.

Note that both Rublon Authentication Proxy and Rublon Access Gateway can be used for both RADIUS and LDAP(S) authentication sources.

Enable Entra ID logins to Palo Alto GlobalProtect using Rublon MFA

If Palo Alto GlobalProtect authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to Palo Alto GlobalProtect with Microsoft Entra ID credentials, even when Palo Alto GlobalProtect does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Demo Video

YouTube player

Before You Start

Ensure you have properly configured Palo Alto GlobalProtect VPN.

Ensure that you have properly set up your authentication source, that is an external Identity Provider (IdP) like FreeRADIUS, FreeIPA, OpenLDAP, or Microsoft Active Directory.

Configuration of MFA for Palo Alto GlobalProtect

Depending on your requirements, you will have to use either Rublon Authentication Proxy or Rublon Access Gateway. Both solutions have their advantages.

Both Rublon Authentication Proxy and Rublon Access Gateway support RADIUS (FreeRADIUS) and LDAP (FreeIPA, OpenLDAP, Microsoft Active Directory) authentication sources.

Rublon Authentication Proxy supports the following Authentication Methods: Email Link, Mobile Push, Passcode.

Rublon Access Gateway supports all Authentication Methods.

MFA for Palo Alto GlobalProtect VPN using RADIUS

Integrate Palo Alto GlobalProtect VPN with Rublon to introduce Multi-Factor Authentication (MFA) to your logins. You have to install and configure Rublon Authentication Proxy before configuring Rublon MFA for Palo Alto GlobalProtect VPN using RADIUS.

How to enable MFA for Palo Alto GlobalProtect VPN – RADIUS

MFA for Palo Alto GlobalProtect VPN using LDAP(S)

Integrate Palo Alto GlobalProtect VPN with Rublon to introduce Multi-Factor Authentication (MFA) to your logins. You have to install and configure Rublon Authentication Proxy before configuring Rublon MFA for Palo Alto GlobalProtect VPN using LDAP(S).

How to enable MFA for Palo Alto GlobalProtect VPN – LDAP(S)

MFA for Palo Alto GlobalProtect VPN using SAML

Integrate Palo Alto GlobalProtect VPN with Rublon to introduce Multi-Factor Authentication (MFA) to your logins. You have to install and configure Rublon Access Gateway before configuring Rublon MFA for Palo Alto GlobalProtect VPN using SAML.

How to enable MFA for Palo Alto GlobalProtect VPN – SAML

Troubleshooting

If you encounter any issues with your Rublon MFA integration, contact Rublon Support.

Related Posts