EG EAP-TTLS authentication failure with Palo Alto Networks GlobalProtect

Products

• VIP Service

Issue/Introduction

EAP-TTLS authentication fails when connecting to VPN via Palo Alto Networks GlobalProtect and Enterprise Gateway.

The Validation Server has been configured with the required EAP-TTLS key in accordance with the official product documentation.

RADIUS Server Profile: Configured on the Palo Alto Networks firewall as follows:

When attempting to establish a VPN connection via GlobalProtect, the authentication fails with the error "EAP-TTLS processing failed: Failed to read cleartext data".

Validation Server Log Snippet:

TEST:1812 0 0 "text=VSValidationEngineProcessRequest() -- Processing EAP request with outer identity [TEST]" Thread-5076 VSValidationEngine.c
TEST:1812 0 0 "text=EAP session retrieved: sessionKey=<sessionKey>, state=CHALLENGE" Thread-5076 VSValidationEngineEAP.cpp
TEST:1812 0 0 "text=Parsed EAP Packet: Code=2, ID=3, Length=75, Type=21" Thread-5076 EAPPacket.cpp
TEST:1812 0 0 "text=TLS_FeedEncryptedData: fed 65 bytes to OpenSSL BIO" Thread-5076 TLSContext.cpp
TEST:1812 0 0 "text=VSValidationEngineProcessRequest() -- EAP processing failed: Error 18527 occurred at VSValidationEngineEAP.cpp:494. Description: VSValidationEngineEAP_ProcessRequest() -- EAP-TTLS processing failed: Failed to read cleartext data" Thread-5076 VSValidationEngine.c

Environment

VIP Enterprise Gateway 9.11.3

Resolution

As per Palo Alto admin guide, EAP-TTLS is supported when password or token or pin are provided together, which is non-interactive access-challenge flow. To support challenge-response flow, one of PAP, PEAP or GTC is to be used. Palo Alto GlobalProtect VPN is not supporting interactive access-challenge flows in the EAP-TTLS-PAP mode.

We recommend implementing the following authentication flow when integrating with Palo Alto Networks GlobalProtect:

• ULO Mode: Users can authenticate using one of the following methods:
  • Password + OTP: Enter the LDAP Password + Security Code (OTP) directly.
  • Push Authentication: Enter the LDAP Password alone, which automatically triggers a VIP Push notification (provided the user has an active push credential registered).