topic Re: RADIUS (not Active Directory) and Allow List in General Topics

RADIUS (not Active Directory) and Allow List

a.cadarso — Tue, 09 Mar 2010 17:40:27 GMT

Hi, I'm configuring a RADIUS different than Active Directory, I use Radius users for SSL-VPN and GUI and all works fine but always I've to add manually the Radius user to Allow List in Authentication Profile, is there any way to avoid this. If I've to add users in Palo ALto then I don't need Radius.

Thank you in advance

Samuel

Re: RADIUS (not Active Directory) and Allow List

rps — Tue, 09 Mar 2010 18:24:46 GMT

Isnt it possible to select "known-user" as with source user and policies?

Re: RADIUS (not Active Directory) and Allow List

swhyte — Tue, 09 Mar 2010 19:17:37 GMT

Hello A.Cardaso,

You will always need to add the users to the allow list in the authentication profile if you are not going to user the local database. The authentication profile defines what users/groups will be allowed to connect over the VPN and how they will be authenticated.

You mentioned the following:

If I've to add users in Palo ALto then I don't need Radius.

When you add users to the allow list, these are actually users that are already in active directory. Those users' credentials still need to be submitted to the radius server for verification. That is the significant difference between using local data base and radius.

Currently there isn't a mechanism on the Paloalto device to automatically add all of the AD users to the all list in the ssl vpn authentication profile.

thanks

Re: RADIUS (not Active Directory) and Allow List

akopp — Mon, 31 May 2010 22:21:54 GMT

Hi Samuel,

Can you try adding the magic word "all" (without the double quotes) in your Authentication Profile -> Edit Allow List -> Additional Users : "all"

It should work if you run 3.1.x, and hit commit.

Arnaud.