topic Config admin using radius group. in General Topics

Config admin using radius group.

inderjit21 — Tue, 17 Mar 2026 05:01:46 GMT

I have VM-100 running panos-11.1.13. currently i have local admins for msp -superusers and 1 customer user with a customer -admin-role profile. customer wants to have mutiple admins controlled by their radius. so radius profile and auth profile is configured. how can i attach admin user group(listed under auth profile) to admin role profile.

I see long way of getting list of users ,configure them attaching radius auth profile and admin role profile. or ldap would be better as i can extract group mapping in user identification.

Re: Config admin using radius group.

reaper — Tue, 17 Mar 2026 12:13:50 GMT

You can't add groups in your authentication profile

For radius auth you can either create local accounts and set an authentication profile, or you can change the device level authentication settings to accept radius credentials. that way the radius server decides which accounts to accept and which attributes to return to the firewall (superuser, device admin,...)

Re: Config admin using radius group.

inderjit21 — Fri, 20 Mar 2026 03:47:06 GMT

thanks for the info. Currently I havent setup auth profile under auth setting so radius users were failing -complaining cant find radius profile. i created a radius user under administrator account and this radius user can access firewall. I dont want to create users under administrator so I will go ahead with configuring admin profile under auth setting. But i have msp administrators on the firewall who r superusers. My only concern is setting auth profile will not cut off these superuser from logging to fw?

Re: Config admin using radius group.

reaper — Mon, 23 Mar 2026 09:37:27 GMT

local accounts will remain active (and preferred) while a system authentication profile is active, so make sure there's no overlap