Panorama admin authentication and Admin Roles

coldstone1 — Tue, 10 May 2016 13:50:16 GMT

Hello,

Is there a best practices guide regarding Panorama Admin roles that includes the pros and cons of using Radius vs Active Directory or even TACACS+ to authenticate Firewall/Network admins. What are other large Enterprise environments doing?

Goals:

1. Minimize account administration in multiple locations

2. As we already have strong Active Directorty IDM in place, would like to leverage membership in AD groups directly from the Panorama Admin Role (i.e. not leverage Radius). Not a huge fan of Cisco ACS and not looking to purchase a different solution.

3. Leverage the same schema across all firewalls

4. Not interfere with USER-ID

Currently we are running Panorama 7.06 and in the process of upgrading 100+ FW's to 7.06 , currently on 5.0.14-h3.

Re: Panorama admin authentication and Admin Roles

rmonvon — Tue, 10 May 2016 13:59:58 GMT

Hi...Since you want to leverage group membership for admin access, I recommend using RADIUS authentication with Microsoft NPS. There are several discussions on this and here's one:

https://live.paloaltonetworks.com/t5/General-Topics/Palo-Alto-RADIUS-authentication-against-Microsoft-NPS-is-broken/m-p/65434#M39075

The PA supports Radius VSA to tie to AD groups:

https://live.paloaltonetworks.com/t5/Configuration-Articles/RADIUS-Vendor-Specific-Attributes-VSA/ta-p/60273

You can use Panorama with template to push the admin access control & admin roles to all PAs on the networks.

Thanks,

topic Re: Panorama admin authentication and Admin Roles in General Topics

Panorama admin authentication and Admin Roles

Re: Panorama admin authentication and Admin Roles