topic Re: Authenticating GP users to Prisma Access with user certificates? in Prisma Access Discussions

Authenticating GP users to Prisma Access with user certificates?

LCMember40912 — Wed, 11 Sep 2024 20:02:52 GMT

Hi folks,

We are currently using an LDAP auth profile to auth our GP clients to PA. This is working fine, but the portal logs are just swamped with brute force attacks day & night and PAN refuses to fix this, so we are wanting to move over to certificate authentication instead.

In brief, we have an AD-integrated MS PKI that issues user and machine certs via group policy. The machine certs are currently being used successfully to authenticate machines in a 'pre-logon' profile before the user logs in, so it would seem this is possible, but for the life of me I cannot figure out what is necessary to configure this for user auth through the Strata Cloud Manager (we do not use Panorama), and I'm completely unable to locate any PAN documentation describing this configuration process.

Can anyone here help?

Thanks very much!

Re: Authenticating GP users to Prisma Access with user certificates?

husingh — Thu, 12 Sep 2024 19:03:42 GMT

Hi @LCMember40912 ,

There is a section called "copilot" in SCM can you paste you query to find out the configuration guidance meanwhile we are checking internally.

Re: Authenticating GP users to Prisma Access with user certificates?

LCMember40912 — Thu, 12 Sep 2024 20:44:11 GMT

Hi, I do not have a 'Copilot' section in SCM. Thanks for your suggestion however.

Re: Authenticating GP users to Prisma Access with user certificates?

LCMember40912 — Fri, 13 Sep 2024 20:43:51 GMT

I'm going to suspend this topic. My goal in moving toward cert auth was to eliminate the flood of brute-force attacks against the portal. Turns out that won't help. The web portal can't be disabled, even if GP uses cert auth, so as long as the portal is up, people are free to brute force it to their heart's content and there's absolutely nothing you can do about it until PAN gets off their butt and address it. Really bad look for an erstwhile 'security' organization...

Re: Authenticating GP users to Prisma Access with user certificates?

husingh — Fri, 13 Sep 2024 21:15:54 GMT

@LCMember40912 apology for the incovinience.

https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-mobile-users/enable-mobile-users-to-authenticate-to-prisma-access

Please go though above document(Enable Mobile Users to Authenticate to Prisma Access).

This document has the available options to authenticate mobile users.

Re: Authenticating GP users to Prisma Access with user certificates?

VTQNetwork — Thu, 17 Oct 2024 16:50:26 GMT

Yeah, I have the same problem with brute force.

It’s possible to deny the traffic by country, but not by the source IP.

With Allow Lists you can prevent sending brute force logins to your AD, but you will continue to see the logs.

AFAIK, it’s not possible to configure security policy on the internet-portal traffic neither block by source IP address.

Re: Authenticating GP users to Prisma Access with user certificates?

LCMember40912 — Thu, 17 Oct 2024 20:45:47 GMT

"It’s possible to deny the traffic by country, but not by the source IP."

No, you can put subnets as well as regions in the embargo list...

Re: Authenticating GP users to Prisma Access with user certificates?

VTQNetwork — Mon, 21 Oct 2024 06:18:50 GMT

Interesting - do you have positive results with blocking /32 „subnets”?

I’ve added my own IP address to the working embargo policy but I was still able to access both Portal & Gateways.

Re: Authenticating GP users to Prisma Access with user certificates?

LCMember40912 — Mon, 21 Oct 2024 15:44:19 GMT

Yes. Check logs for failed username and passwords, add the source IP's\ranges to the embargo and watch them disappear.