topic Re: Authenticating Panorama users with AD in General Topics

Authenticating Panorama users with AD

robert.b — Tue, 13 Jul 2010 15:55:41 GMT

Is it possible to authenticate users using their AD credentials when they log into Panorama? Short of giving administrators their own login into Panorama, I'm unable to track who has changed what.

I've read through the LDAP guide, but it focuses on the actual security devices and not Panorama.

Has anyone done this or know if it is possible?

Thanks

Re: Authenticating Panorama users with AD

mharding — Tue, 13 Jul 2010 18:28:20 GMT

Yes, but you'll need a RADIUS server. You'll add the Panorama to the RADIUS clients using the RADIUS standard client-vendor attributes. Then create a strong password for the shared secret. Write that down, and we'll come back to that next.

Then you'll need to add the RADIUS policies. For a Windows RADIUS server, we use the "Client Friendly Name Matches" and use the name of the RADIUS client you just added, and "Windows-Groups matches" for the group of users you want to authenticate.

Then click on the "Edit Profile" button. Under the authentication tab, check everything but "Encrypted authentication (CHAP)" and "Allows clients to connect without negotiation an authenticate method."

Then stop and start the RADIUS server.

Then create a RADIUS profile in Panorama. Added the IP address of the RADIUS server and enter to shared secret you assigned for that server. Then you should be able to add the administrative user's short name, and select the checkbox for RADIUS authentication. Commit the change and try it out.

I think that's everything we had to do to make it work.

Re: Authenticating Panorama users with AD

robert.b — Wed, 14 Jul 2010 07:23:16 GMT

Thanks, I'll see if we can get the Windows IAS installed.

Pity it can't just use LDAP!

Re: Authenticating Panorama users with AD

mharding — Wed, 14 Jul 2010 13:00:22 GMT

If it can, I haven't bothered. We set it up before PAN OS 3.1.

Re: Authenticating Panorama users with AD

mjacobsen — Fri, 23 Jul 2010 17:42:17 GMT

You should be able to use LDAP directly for checking the account credentials but you would still need to setup the admin accounts within Panorama as it will only use the LDAP connection for checking the password. If you want to avoid setting up the accounts explicitly, you can use RADIUS VSAs to have Panorama (or the device) leverage directory information to determine which accounts should have access to the system (and what level of access).

Mike

Re: Authenticating Panorama users with AD

jhickey — Mon, 25 Apr 2011 19:15:21 GMT

Mike, I cant get this to work. I set up AD Admin auth just like it is setup on my firewalls. I get invalid username/password.

Re: Authenticating Panorama users with AD

jhickey — Mon, 25 Apr 2011 19:21:48 GMT

nevermind I got it.. DN of the id to query AD had a syntax error.