I need 2FA for administrator access to PaloAlto firewalls. Not SSO. The user credentials cannot be Active Directory for PCI reasons. The accounts for the administrators will need to be in Duo, and the admins will need to be able to change their pass...