topic Re: Differentiate GP portal login(not client login) vs MGMT login in General Topics

Differentiate GP portal login(not client login) vs MGMT login

SuryaR — Thu, 01 Jun 2017 18:26:48 GMT

Has anyone run across issues where Radius server is having difficulty in identifying if it's a management login vs GP portal login.

We are having a hard time to identify the difference, when we use Clear pass as our radius server.

Little Background:

A user(valid admin) uses his creds to login to the GUI. PA uses its mgmt interface to send creds, to validate with Radius(clearpass in our case).

A user(regular user not admin) uses his creds to log in to GP portal(not GP client- GP client works fine as it sends different Radius -VSattr. in the request). PA again uses the mgmt interface.

Radius server in the backend has difficulties in identifying difference between (1) and (2). Any one had seen this.?

Re: Differentiate GP portal login(not client login) vs MGMT login

Remo — Thu, 01 Jun 2017 19:47:18 GMT

I would recommend using different credentials for your admin login. In this case it would be easy to distinguish between a normal and an admin user.

The other possibility you have is using different authentication profiles with the same radius server profiles attached to it. Paloalto devices send the authentication profile name as an attribute in the radius request, which you could use in different radius authentication rules to itentify which login comes from GP and which one from an admin login.

Re: Differentiate GP portal login(not client login) vs MGMT login

SuryaR — Fri, 02 Jun 2017 17:09:33 GMT

Thank you for the reply.

I tried adding same radius servers as a part of different authentication profile. It didnt work.

I cannot have same radius servers in different auth-profiles.

Still reasearching on how to configure this right.

Re: Differentiate GP portal login(not client login) vs MGMT login

Remo — Fri, 02 Jun 2017 17:19:17 GMT

What PAN-OS version do you use?

Because I have done exactly this: same RADIUS server profile in different authentication profiles so on the RADIUS server we are able to identify to which user directory the request has to be forwarded.

I have configured this on panorama running 8.0.2.

Re: Differentiate GP portal login(not client login) vs MGMT login

SuryaR — Fri, 02 Jun 2017 19:06:30 GMT

I am using 7.1.6.

I have tried what you have mentioned below, but in my case I dont see it in the dropdown.

One other thing is we dont have a definitive group of people in the Radius users group, In other words, it is "all"

Hope I made sense.

Re: Differentiate GP portal login(not client login) vs MGMT login

Remo — Fri, 02 Jun 2017 19:15:45 GMT

What item does not show up and in which dropdown?

May be you could share screenshots?

Re: Differentiate GP portal login(not client login) vs MGMT login

SuryaR — Fri, 02 Jun 2017 19:42:48 GMT

Now I Understood it correctly. I was always focusing on the Radius tab, but I should have to configure in the authentication profile tab as two different profiles.

I tested and it worked. Thanks for the idea and your time.

Appreciate your replies.