topic Re: Authentication Policy Cisco ASA to Palo Migration in Expedition Discussions

Authentication Policy Cisco ASA to Palo Migration

yaz3636 — Thu, 17 Sep 2020 10:22:44 GMT

Hi All,

I'm just looking for some help in migrating an authentication policy for my customer. I have tried to do this in expedition but I'm not sure it works. The Cisco ASA config I am trying to migrate is decribed below:

aaa-server RadiusProfile protocol radius
aaa-server RadiusProfile (Inside) host 192.168.1.1
key MySecret

aaa authentication match AuthPolicy Inside RadiusProfile

access-list AuthPolicy line 1 extended permit ip 172.16.0.0 255.255.0.0 any4

I have tried creating an Authentication Profile on the Palo with a subsequent Authentication Enforcement Object. That is directly referenced in the Authentication policy which follows the asa access-list (permit zone Inside source address 172.16.0.0/16 to any destination) but I do not believe it is working.

When I attempt to test it, the authentication policy has no hits on it.

Looking for some help please if any of you have knowlege of this area.

Best Regards

Re: Authentication Policy Cisco ASA to Palo Migration

lychiang — Thu, 17 Sep 2020 14:56:11 GMT

Hi @yaz3636

Please refer below article on how to configure authentication policy in Palo Alto Networks

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/policies/policies-authentication/create-and-manage-authentication-policy.html#idc43c52bf-b641-415d-b573-5914b67c4b4d

Re: Authentication Policy Cisco ASA to Palo Migration

yaz3636 — Thu, 17 Sep 2020 15:01:08 GMT

Hi @lychiang

Yes I have followed these steps in the link you sent.

Server Profile >

Auth Profile > (referencing Server Profile)

Authentication Object > (Referencing Auth Profile)

Authentication Policy > (referencing the Auth Object)

I am still unable to get a hit on the authentication, I have used service any as a catch all, tested with SSH and Pings and still unable to get a hit.

Regards

Re: Authentication Policy Cisco ASA to Palo Migration

lychiang — Thu, 17 Sep 2020 15:03:28 GMT

As I know this works on web traffic only . You might want to test with web traffic , if there is any questions , please open a TAC case.