> For the complete documentation index, see [llms.txt](https://docs.mirketsecurity.com/mirket-help-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mirketsecurity.com/mirket-help-center/mirket-help-center/mirket-on-premise-platform/3rd-party-integrations/palo-alto-mfa-for-admin-accounts.md).

# Palo Alto MFA for admin accounts

Palo Alto Networks GlobalProtect Integration

## General Overview

This guide explains the instructions on configuring Mirket multi-factor authentication for Palo Alto Networks Admin login . 

## Configuring Palo Alto

Follow these steps to configure Palo Alto:

### RADIUS Service Configuration

* Select the **Device** tab and go to **Service Profiles > Radius** from the menu.
* Click on **Add** to create a new profile.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2F1sDJj2akocn5biQGMav1%2Fpaloalto.jpg?alt=media&amp;token=a7fad564-996c-4016-816b-0157d64c1cf5" alt=""><figcaption></figcaption></figure>

* Enter a name in the **Profile Name** field; for instance, "MirketRadius".
* Input "**60**" in the **Timeout** field.
* Input "**1**" in the **Retries** field.
* Choose **PAP** option from the **Authentication Protocol** dropdown list.
* Click on **Add** to add a Radius server, in the **Servers** section.
* Enter a name for the Radius server; for instance "MirketGW".
* Input the IP address of the server where the "**Mirket Radius**" is installed in the **RADIUS Server** field.
* Input a shared secret key to communicate with the RADIUS server in the **Secret** field (Mirket Radius). In Mirket use this same secret key when [configuring a RADIUS client resource](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/rules/radius-rules/radius-clients.md).
* Input "**1812**" in the **Port** field. You should define your own port here. Then click on **OK** to confirm settings.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FOhHiv8ASVNWdMG2dxWnu%2Fpaloradiuspage1.png?alt=media&amp;token=c140378c-c833-4391-baf2-f93cad11472d" alt=""><figcaption></figcaption></figure>

* Return to the **Device** tab and go to **Setup**, from the menu. Then select the **Services** tab.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2Fr0IRjGh1JzmpMuIQ495t%2Fpaloradiuspage2.png?alt=media&amp;token=d7caa0dd-7eae-4236-9866-fd6d140a6332" alt=""><figcaption></figcaption></figure>

* &#x20;Click on **Service Route Configuration** under the **Service Feature**.
* Check the IP address Palo Alto connect for radius request and make sure radius packets  (Udp 1812 and Udp 1813) are allowed between Palo Alto and Mirket.&#x20;

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FxdLfic4OE6scDEIAlxUt%2Fpaloservicerouteconfig.png?alt=media&amp;token=744b2bbd-c12f-44a9-b066-cc3d417c2d4c" alt=""><figcaption></figcaption></figure>

### Authentication Profile Configuration

* Select the **Device** tab and go to **Authentication Profile**, from the menu.
* Then, click on **Add** to create a new profile.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FgQ3KhDWNXl727UrPs4Ub%2Fpaloaddauthenticationprofile.png?alt=media&amp;token=abb3a83d-4187-4906-9ae0-d0ccd51878e4" alt=""><figcaption></figcaption></figure>

* Enter a name for the authentication profile; for instance, RadiusMirketProfile.
* Choose "**RADIUS**" option from the **Type** dropdown list.
* Choose the previously created [RADIUS service](#radius-service-configuration) profile from the **Server Profile** dropdown list(e.g., MirketRadius).
* Enter a  domain  name in the **User Domain** field.&#x20;
* Click on the **Advanced** tab.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2F6ACSh2vvpOjPLoXui3LZ%2Fpaloauthenticationall.png?alt=media&amp;token=f493d528-0a86-4f7b-8dac-cb8432cea99f" alt=""><figcaption></figcaption></figure>

* Then, choose "**all**" option in the **Allow List**.
* Then, **Click OK.**&#x20;
* Then click on **Commit** to save settings on the top right side.

### Administrator Account Configuration

* Select the **Device** tab and go to **Administrators**, from the menu.
* Then, click on **Add** to create a new administrator account.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2F6gkm7YvycNM0ecY5N84a%2Fpaloadministrator.png?alt=media&amp;token=cd403538-b6d1-4347-ba24-d69b1f6ca6a3" alt=""><figcaption></figcaption></figure>

* Enter a name for the administrator account in the Name field. In this instance, we input the name as "**johnson**".
* Choose the previously created Authentication profile from the **Authentication Profile** dropdown list (e.g., RadiusMirketProfile).
* Choose the "**Superuser**" option from the **Administrator Type** dropdown list.
* Click on **OK** to confirm settings.
* Click on **Commit** to save settings on the top right side.

## Configure Mirket

To enable Mirket to receive authentication requests from GlobalProtect, follow these steps:

### Add a Palo Alto as Resource in Mirket

To set up multi-factor authentication, make sure you have added at least one RADIUS client in Mirket. To learn how to add a RADIUS client, refer to the link below.

* [How to add a RADIUS client in Mirket](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/3rd-party-integrations/add-a-radius-client-in-mirket.md)

### User and Group configuration on Mirket&#x20;

To set up multifactor authentication, make sure you have at least one **user** or **group** in Mirket.

If it is preferred to use a local user, you can first create a local group and then create a local user and make the user a member of the group. Alternatively, you can create a local user without creating a local group.

* [Create a Local Group to add users manually.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/groups.md)
* [Add local Mirket users manually.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/users/local-users.md)

If it is preferred to use LDAP users, the priority External Source is created by pulling users from Active Directory or OpenLDAP in Mirket.

* [Create an External Source to include LDAP users.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/external-sources/active-directory.md)
* [Sync users from an external user database.](/mirket-help-center/mirket-help-center/mirket-on-premise-platform/configuration/user-profile/users/ldap-users.md)

### Add a Radius Rules to Mirket

Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP etc.).

First, you should follow these steps:

* Go to **Configuration > Radius Rules**.
* Click on the **Add Rule** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FjBK348L1wwFifiewwnDq%2FradiusRuleAdd1.png?alt=media&amp;token=5f7937d1-4904-43f6-ab66-d5cae79ea771" alt="" width="563"><figcaption></figcaption></figure>

* On the displayed screen, enter a name for the rule in the **Name** field.
* Enter the rule description in the **Description** field.
* Enter the source IP addresses to which the rule will apply in the **Source Adress** field.
* Click on the **Next** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FcEzuQjwvb54ts9KftwGZ%2FradiusRuleAdd2.png?alt=media&amp;token=ccd4f382-af7e-4af8-b428-d91e00803626" alt="" width="563"><figcaption></figcaption></figure>

* Specify whether the rule will be applied to a user or a group.
* After specifying, click on the **Next** button.

<div><figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FfjgvKcxYBVqIcCD7DO4I%2FradiusRuleAdd31.png?alt=media&amp;token=eb5ed32c-6ed4-4e82-88d2-ca79856c0bd0" alt=""><figcaption></figcaption></figure> <figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FzrIuN4vMBAPo4AD8Ckpx%2FradiusRuleAdd32.png?alt=media&amp;token=0bd8296a-8859-448d-8ce7-504571aef05f" alt=""><figcaption></figcaption></figure></div>

* Select the users or groups to which the rule will apply. Transfer your selections to the **Selected Users/Groups** table by clicking the arrow icon next to the **Available Users/Groups** table.
* Click on the **Next** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FKAqhZPRxq5ZPEyRlJMKy%2FradiusRuleAdd4.png?alt=media&amp;token=75e7f8ac-8b9b-4ad6-8f17-99a98d20f371" alt="" width="563"><figcaption></figcaption></figure>

* Select the time period when the rule will run.
  * **All**: The rule will run every day.
  * **Recurring**: The rule will run on the specified days and times.
  * **One Time**: The rule will run within the date range you specify.
* After selecting, click on the **Next** button.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2Fw15CayFVYK4JkreQogOH%2FradiusRuleAdd5.png?alt=media&amp;token=ad72a55f-4ae0-4ff5-a068-3c21fd59a448" alt="" width="563"><figcaption></figcaption></figure>

* Specify whether the user or group will be granted access based on the rule in the **Action** field.
* Select the authentication provider to which the rule will apply from the **Auth Method** dropdown list.
* Click on **Save** to confirm the settings.

<figure><img src="https://2335748515-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXMCDrulGJr20rbbYKJ91%2Fuploads%2FMxZcjlh9zBXm4cd1JplV%2FradiusRuleList.png?alt=media&amp;token=827be7dc-6940-4e0a-be06-cdb154268be5" alt=""><figcaption></figcaption></figure>

#### Related Topics

[Palo Alto SSL VPN Integration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/integrations/palo-alto-ssl-vpn-integration.md)

[Radius Clients](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/rules/radius-rules/radius-clients.md)

[Radius Rules](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/rules/radius-rules.md)

[Local Group Configuration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/local-group-configuration.md)

[Local Users Configuration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/local-users-configuration.md)

[LDAP Group Configuration](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/ldap-group-configuration.md)

[LDAP Users](/mirket-help-center/mirket-help-center/mirket-old-versions-op/mirket-admin-panel/user-management/ldap-users.md)