topic Re: Is it possible to create AD group based authentication for PaloAlto administrators? in General Topics

Is it possible to create AD group based authentication for PaloAlto administrators?

Gururaj — Tue, 27 Aug 2013 11:15:28 GMT

Hi All,.

Is it possible to create AD group based authentication for PaloAlto administrators?

If yes, kindly provide the steps for the same.

Regards,

Gururaj

Re: Is it possible to create AD group based authentication for PaloAlto administrators?

VinceM — Tue, 27 Aug 2013 12:02:48 GMT

Hi,

If your question is about using a group instead of users for admin, answer is no .... not yet

Else for sure you can group all your pa'sadmin in AD group and use all user in this group for defining admin profile and role.

What you have to do is to follow this doc: https://live.paloaltonetworks.com/docs/DOC-4740,create your admin account in the palo then assign them to admin role.

Hope help

Re: Is it possible to create AD group based authentication for PaloAlto administrators?

rmonvon — Tue, 27 Aug 2013 13:55:48 GMT

You can use Radius VSA to accomplish group permission for admin. Here's a doc on Radius VSA and configuration examples for Windows server: Radius Vendor Specific Attributes (VSA) .

Thanks.

Re: Is it possible to create AD group based authentication for PaloAlto administrators?

mbutt — Tue, 27 Aug 2013 23:00:15 GMT

If you are planning to use a group name under Device ---> administrator then it wont work

You have to user individual user names with LDAP as authentication profile.

Step1:

create LDAP profile

Device --> Server Profiles ---> LDAP

Step2:

Create authentication profile under Device --> Authentication Profiles

Step3:

Now select under Device --> administrator

Create an Administrator user. Make sure the user name is same as on the DC other wise the user will not able able to login.

Now commit the changes and the user will be able to login.

However if this is not feasible for you and you do not want to configure all you users here . You can also use Radius and set it with Admin Roles.

Here is a doc that explains how to do that.

https://live.paloaltonetworks.com/docs/DOC-1765

Hope this helps.

Thanks

Numan

Re: Is it possible to create AD group based authentication for PaloAlto administrators?

mbutt — Tue, 27 Aug 2013 23:01:28 GMT

Here is another doc which explains on how to setup LDAP authentication

https://live.paloaltonetworks.com/docs/DOC-2910

Let us know if this helps.
Thanks

Numan