According to Palo Alto Networks documentation123, multi-factor authentication (MFA) is a method of verifying a user's identity using two or more factors, such as something they know, something they have, or something they are.
The firewall supports MFA for administrative access, GlobalProtect VPN access, and Captive Portal access. The firewall can integrate with external MFA providers such as RSA SecurID, Duo Security, or Okta Verify.
The three firewall MFA factors that are supported by PAN-OS are:
User logon: This is something the user knows, such as a username and password.
One-Time Password: This is something the user has, such as a code generated by an app or sent by email or SMS.
Push: This is something the user is, such as a biometric verification or a device approval.