Failed authentication for user to login PA firewall – Reason: Invalid username/password

Situation: After client configures DUO MFA on their Palo Alto Firewall, one of users has a problem to login the firewall with this message:

Failed authentication for user ‘username’.
Reason: Invalid username/password. auth profile
‘DUO Authentication’, vsys ‘shared’, server profile
‘DUO Radius Profile’, server address ‘10.0.0.11’,
auth protocol ‘PAP’, reply message
‘Invalid username or password’ From: 10.0.0.11.

Troubleshooting: Make sure Duo Mobile app is not deactivated. Also make sure the account of DUO-PROTECTED had not been disabled on the DUO app.

Please refer to this post:

• Fixing Palo Alto Firewall Authentication Issues: Timeout

Also please refer to this post:

• How to install or Activate DUO app