Configure optional settings

The Palo Alto Networks Gateway supports several optional settings.

Configure Client IP Reporting

The Palo Alto Networks next-generation firewall (NGFW) doesn't send the client IP using the standard attribute value pairs (AVP), such as 31 (Calling-Station-Id). It sends the data using a vendor-specific attribute (VSA) instead.

Follow these steps to configure Okta to parse, report, and enforce policy based on the source client IP address:

  1. In the Admin Console, go to ApplicationsApplications.

  2. In the list of applications, find Okta Palo Alto Radius App.
  3. In the Advanced RADIUS Settings section, select Report Client IP.
  4. For RADIUS End User IP Attributes, select 26 Vendor-Specific, and then enter 7.
  5. Click Save.
  6. Open the Palo Alto Networks administrative shell and run this command:

    set authentication radius-vsa-on client-source-ip

Configure Groups Response options

The Palo Alto Network Gateway doesn't receive groups using the standard AVP of 11 (Filter-Id) and 25 (Class). It uses a VSA instead.

To configure the app to send RADIUS group information in vendor-specific attributes, complete the following steps:

  1. In the Admin Console, go to ApplicationsApplications.
  2. Find the application using the Search field and then click its name in the search results.
  3. Select the Sign on tab.
  4. Scroll to the Advanced RADIUS Settings section and then click Edit.
  5. In the Groups Response section, complete the following options:
    1. Select Include groups in RADIUS response.
    2. In the RADIUS attribute subsection, select 26-Vendor specific.
    3. In the Vendor Specific ID field, enter the numeric vendor ID code for your product:
      • Cisco ASA-Group-Policy: 3076
      • Citrix Group-Names: 3845
      • Fortinet Group-Name: 12356
      • Palo Alto User-Group: 25461

      If your vendor-specific ID doesn't appear here, search for it in the documentation for your product.

    4. In the Attribute ID field, enter the numeric attribute ID for your product:
      • Cisco ASA-Group-Policy: 25
      • Citrix Group-Names: 16
      • Fortinet Group-Name: 1
      • Palo Alto User-Group: 5

      If your attribute ID doesn't appear here, search for the group policy attribute in the documentation for your product.

  6. Click Save.

The maximum length of the group membership value is 247 bytes. If the group name length exceeds this limit, it's truncated and partial values are returned. Configure the response as a set of repeated attributes instead of using a single delimited list.

Avoid double credential prompts in GlobalProtect

In certain situations GlobalProtect prompts twice for credentials when configured with Okta RADIUS. You can avoid this by enabling cookies for the GlobalProtect sign-in process. The GlobalProtect portal generates a cookie after a user signs in. The RADIUS Gateway accepts this cookie within a short time window, typically 60 seconds or less.

Enable cookie generation on GlobalProtect Portal

  1. Connect to the GlobalProtect Portal.
  2. Go to NetworkGlobalProtectPortals.
  3. Click Portal Profile.
  4. Select the Agent tab and then click Agent Config.
  5. Enable Generate cookie for authentication override.
  6. In Cookie Lifetime, enter the lifetime in seconds. For RADIUS, this is typically 60-90 seconds.
  7. In Encrypt/Decrypt Cookie, select a certificate.

Enable cookie acceptance in GlobalProtect Gateway

  1. Go to NetworkGlobalProtectGateways.
  2. Open the Gateway Profile.
  3. Select the Agent tab.
  4. Click Client Settings, and then click Client Config.
  5. Select the Authentication Override tab and enable Accept cookie for authentication override.
  6. In Cookie Lifetime, enter the lifetime in seconds. For RADIUS this is typically 60-90 seconds.
  7. In Encrypt/Decrypt Cookie, select a certificate. Select the same certificate that you selected in Enable cookie generation on GlobalProtect Portal.