# Palo Alto > Protect GlobalProtect on Palo Alto with Ironchip using SAML or RADIUS with NPS: authentication profiles, gateway and GlobalProtect portal configuration. URL: https://docs.ironchip.com/en/identidad/integraciones/red/palo-alto/ This guide explains how to integrate **Palo Alto** devices with Ironchip through [SAML](https://docs.ironchip.com/en/identidad/protocolos/saml/) or [RADIUS](https://docs.ironchip.com/en/identidad/protocolos/radius/). The integration lets you centralize user management and strengthen access security. ## SAML ### Requirements - Access to the Ironchip admin console. - A user with permissions to make changes in Palo Alto. - GlobalProtect configured, with a portal and a gateway. ### Configure the SAML profile in Palo Alto 1. Sign in to the Palo Alto Networks admin console with sufficient privileges. 2. Go to **Device > Server Profiles > SAML Identity Provider** and click **Import** to define a new SAML IdP. [Image: Device > Server Profiles > SAML Identity Provider menu] [Image: SAML IdP import window] 3. Enter these details: - **Profile Name**: a unique, descriptive name. - **Identity Provider Metadata**: you get it when you create a SAML application in Ironchip. Download it and upload it with **Browse**. [Image: Downloading the metadata when creating the SAML application in Ironchip] - **Maximum Clock Skew (seconds)**: `60`. [Image: Import SAML Identity Provider Server Profile window] 4. Click **OK** and open the profile you created. 5. Clear **Validate Identity Provider Certificate** and **Sign SAML Message to IDP**. 6. Click **OK** to save. [Image: SAML profile with Validate Identity Provider Certificate and Sign SAML Message to IDP cleared] ### Get the metadata for Ironchip 1. Go to **Device > Authentication Profile** and click **Add**. [Image: Device > Authentication Profile menu] 2. Change these parameters: - **Name**: a descriptive name. - **Type**: `SAML`. - **IdP Server Profile**: the SAML profile you created. - **Enable Single Logout**: selected. - **Username Attribute**: `uid`. - **User Group Attribute**: `eduPersonAffiliation`. [Image: SAML authentication profile parameters] 3. Click **OK**. In the list of authentication profiles, click the **Metadata** link of the profile you just created. [Image: Metadata link of the profile in the list of authentication profiles] 4. In the **Export SAML Metadata** window, select `management` in **Service**, enter the connection IP of your VPN and download the metadata. [Image: Export SAML Metadata window with the management service and the VPN IP] 5. Upload the downloaded file to a public internet address and copy its raw URL into the **Metadata URL** field of the Ironchip application. [Image: Metadata URL field of the application in Ironchip] :::note In the current version of the console, the SAML application has the **Service Provider (SP)** section with the **SP Metadata** field, which accepts **URL**, **Text** and **File**. Select **File**, choose the downloaded file and click **Import**: you do not need to upload it to a public address. ::: ### Apply the SAML profile to the gateway 1. Go to **Network > GlobalProtect > Gateways** and open your GlobalProtect gateway. 2. On the **Authentication** tab, under **Client Authentication**, click **Add** to update client authentication with the profile you just configured. 3. Leave the default settings except for these fields: - **Name**: a unique, descriptive name. - **OS**: `Any`. - **Authentication Profile**: the authentication profile you configured earlier. - **Authentication Message**: instructions for end users, such as `Enter login credentials`. 4. Click **OK** to save. [Image: Gateway client authentication with the SAML profile] ### Apply the SAML profile to the GlobalProtect portal Apply to the portal the same configuration you just applied to the gateway. 1. Go to **Network > GlobalProtect > Portals** and open your GlobalProtect portal. 2. On the **Authentication** tab, under **Client Authentication**, click **Add** to update client authentication with the SAML profile. 3. Leave the default settings except for these fields: - **Name**: a unique, descriptive name. - **OS**: `Any`. - **Authentication Profile**: the authentication profile you configured earlier. - **Authentication Message**: instructions for end users, such as `Enter login credentials`. 4. Click **OK** to save. [Image: Portal client authentication with the SAML profile] ### Verify the integration Give users access to the application created in the Ironchip console. Connect with the GlobalProtect client as one of them: when you sign in, you are asked to authenticate with Ironchip. ### Administrator with SAML (optional) 1. Go to **Device > Administrators** and create an administrator profile or edit an existing one. [Image: Device > Administrators section] 2. In **Authentication Profile**, select the SAML profile you created. [Image: SAML authentication profile in the administrator] 3. Go to **Device > Setup** and, on the **Management** tab, edit **Authentication Settings** with the gear icon. [Image: Authentication Settings section in Device > Setup] 4. In **Authentication Profile**, select the SAML profile you created. [Image: SAML authentication profile in the device settings] ## RADIUS Configure Palo Alto to authenticate against RADIUS and integrate it with an NPS server in an Active Directory environment. If you prefer not to use NPS, you can use the [Ironchip RADIUS server](https://docs.ironchip.com/en/identidad/integraciones/red/radius-server/): the connection details (IP, secret and port) are those of that server. ### Requirements - A Windows server with the [NPS](https://docs.ironchip.com/en/identidad/integraciones/red/nps/) role configured and protected by Ironchip. - A RADIUS client created in NPS that points to the Palo Alto IP, with its shared secret. - Access to the Ironchip admin console. - A user with permissions to make changes in Palo Alto. - A working [VPN](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHdCAK) service. ### Create the RADIUS server profile 1. Sign in to the Palo Alto Networks admin console with sufficient privileges. 2. Go to **Device > Server Profiles > RADIUS** and click **Add** to define a RADIUS server profile. [Image: RADIUS Server Profile window with the timeout, retries and the NPS server] 3. Enter a unique, descriptive **Profile Name** and set: - **Timeout (sec)**: `60`. - **Authentication Protocol**: `PAP`. - **Retries**: `1`. 4. Under **Servers**, click **Add** and enter: - **Name**: a unique, descriptive name. - **RADIUS Server**: the IP address of the NPS server. - **Secret**: the shared secret you defined in the NPS RADIUS client. - **Port**: the UDP port NPS listens on for RADIUS, such as `1812`. 5. Click **OK** to save. ### Define the authentication profile 1. Go to **Device > Authentication Profile** and click **Add**. 2. On the **Authentication** tab, leave the default values except: - **Type**: `RADIUS`. - **Server Profile**: the server profile you defined in the previous section. [Image: Authentication tab of the profile with the RADIUS type and the server profile] 3. On the **Advanced** tab, under **Allow List**, click **Add** and select `all`. [Image: Advanced tab with all in the Allow List] 4. Click **OK** and then **Commit** to save the RADIUS authentication profile. 5. Open the Palo Alto Networks CLI and test the authentication profile. ### Apply the RADIUS profile to the gateway 1. Go to **Network > GlobalProtect > Gateways** and open your GlobalProtect gateway. 2. On the **Authentication** tab, click **Add** to update client authentication with the RADIUS profile you just configured. 3. Leave the default settings except for these fields: - **Name**: a unique, descriptive name. - **OS**: `Any`. - **Authentication Profile**: the authentication profile you configured earlier. - **Authentication Message**: instructions for end users, such as `Enter login credentials`. 4. Go to **Agent > Client Settings**, open the client configuration and, on the **Authentication Override** tab, select **Generate cookie for authentication override** and **Accept cookie for authentication override**. [Image: Authentication Override tab with both cookie checkboxes selected] 5. Click **OK** to save. ### Apply the RADIUS profile to the GlobalProtect portal Apply to the portal the same configuration you just applied to the gateway. 1. Go to **Network > GlobalProtect > Portals** and open your GlobalProtect portal. 2. On the **Authentication** tab, click **Add** to update client authentication with the RADIUS profile you just configured. 3. Leave the default settings except for these fields: - **Name**: a unique, descriptive name. - **OS**: `Any`. - **Authentication Profile**: the authentication profile you configured earlier. - **Authentication Message**: instructions for end users, such as `Enter login credentials`. 4. Go to **Agent**, open the agent configuration and, on the **Authentication** tab, under **Authentication Override**, select **Generate cookie for authentication override** and **Accept cookie for authentication override**. [Image: Authentication tab of the portal agent with both cookie checkboxes selected] 5. Click **OK** to save. ### Commit the configuration Click **Commit** to save the RADIUS configuration in the Palo Alto Networks admin console. By default, RADIUS connections go out through the management interface. To change this, see the [Palo Alto Networks knowledge base](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGJCA0). ### Verify the integration Give users access to the application created in the Ironchip console. Connect with the GlobalProtect client as one of them: after you enter your username and password, you are asked to authenticate with Ironchip. ### Troubleshooting - **Authentication fails with a timeout**: check that the RADIUS server profile timeout is `60` seconds and retries is `1`, to give the user time to respond to Ironchip. - **The RADIUS server rejects the connection**: check that the Palo Alto IP is configured as a RADIUS client in NPS and that the shared secret is the same on both sides.