topic Re: Local user authentication in General Topics

Local user authentication

peterpan13888 — Tue, 17 Sep 2013 19:01:19 GMT

Hi all,

What does it mean if I create a rule that allows http/https services only for authenticated users from local user database between 2 zones? Will the users have to authenticate to the firewall first? How?

Thanks!

Peter

Re: Local user authentication

Phoenix — Tue, 17 Sep 2013 19:12:44 GMT

Hello Peter,

Authenticating to the firewall works on the firewall management interface and we do not create rules for this interface.

The rules created are for data ports. If a user is traversing through the PAN between 2 zones and the security rule has http and https only allowed as services then that user can only pass port 80 and 443 traffic between the zones.

Thanks

Re: Local user authentication

kadak — Tue, 17 Sep 2013 19:13:12 GMT

Hello Peter,

Firewall administration (logging and authenticating to the firewall to gain WebUi and CLI access) is done under Device > Administrators. We need to manually add administrators.

If a user-ip mapping comes to the firewall with a username matched to the one in the local database, then traffic would hit that rule allowing http/https service. One scenario you could think of if by using local database as authentication profile in global protect. It really boils down to where you are using local database as an authentication profile on your Palo Alto firewall.

Regards,

Kunal Adak

Re: Local user authentication

hshah — Tue, 17 Sep 2013 19:14:04 GMT

Hi peterpan13888,

In policy there are only 4 options to configure users "any", "known", "unknown" and "select".

As per my knowledge there is no option to configure policy for "local user database", because "local user database" is design only firewall authentication.

Please provide me more information how did you configure "local user database in policy". I would appreciate if you can share few screen shots.

Regards,

Hardik Shah

Re: Local user authentication

peterpan13888 — Tue, 17 Sep 2013 20:01:56 GMT

Actually I am trying to migrate some rules in Juniper firewall and found two that cannot be migrated which allow only locally authenticated users to connect between 2 zones. I just wonder how I can implement the same rules in PA?

Re: Local user authentication

ExclusiveNetworksGermany — Wed, 18 Sep 2013 08:10:04 GMT

Create a Policy between the two zones for "known User" or if you like specific named User. This Policy will only match for authenticated Users.

Create Local User Accounts, (you can also use AD User)

Create a Captive Portal Policy

How to Configure Captive Portal

Cheers

Marco