packet capture on cisco switch

 https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/16-3/configuration_guide/b_163_consolidated_3850_cg/b_163_consolidated_3850_cg_chapter_01001011.html

Palo alto GP MFA setup with MS Azure MFA

 https://www.youtube.com/watch?v=GxRdPPsIHH8&t=1186s

Identifier (Entity ID) URL: https://vpn.domain.com:443/SAML20/SP

The 443 is needed

Reply URL (Assertion Consumer Service URL):  https://vpn.domain.com:443/SAML20/SP/ACS

MFA setting 

https://portal.azure.com/

Burger menu top left > Microsoft Entra ID

Enterprise applcations

Search global protect app "Palo Alto Networks - GlobalProtect"

From the left expand security > conditional access

You will see the policies here

You can see what policoes are being used by expanding Activity on the left

click on Sign in and logs

Make GP connection 

Click on entry for more details

In the top right click on Conditional Access