MFA Methods for Local Administrator Accounts on Palo Alto Firewalls

Quick Answer

The correct answer includes time-based one-time password because it represents the category of MFA that the firewall can validate entirely on its own, without depending on an external authentication service being available at the moment of login. TOTP works by having both the firewall and the administrator's authenticator app derive a code from a shared secret and the current time, using the same standard time-synchronized algorithm, so the firewall can check the submitted code locally rather than forwarding it somewhere else for validation. That local validation is what makes it suitable for local administrator accounts specifically, since those accounts are meant to remain usable even if external authentication infrastructure is down. The other supported path for local account MFA runs through RADIUS, where the external RADIUS server itself generates and validates a one-time password rather than the firewall doing so directly; that's a meaningfully different architecture even though both ultimately produce a one-time code the administrator enters at login. When a question asks how MFA can be layered onto local administrator accounts specifically, rather than accounts tied to an external directory, look for methods the firewall can either validate natively, like TOTP, or coordinate through a dedicated external service like RADIUS, since both paths exist precisely to keep local admin access resilient.