topic Re: Require authentication via global protect when connecting to data center resources in General Topics

Require authentication via global protect when connecting to data center resources

bhughesiii — Mon, 29 Apr 2019 19:51:26 GMT

In an attempt to secure connections to production resources. I would like to implement a policy that if you are for instance using SSMS to connect from one location to a database in the data center, that you first have to authenticate via global protect client using two factor authentication before you can connect to said resource.

any guidance would be greatly appreciated and any requests for more information will be answered as quickly as I can.

Thank you

Re: Require authentication via global protect when connecting to data center resources

BPry — Tue, 30 Apr 2019 22:08:08 GMT

@bhughesiii,

Usually GlobalProtect connections are terminated in their own zone on the firewall. If that's the case in your environment, you would simply modify the existing security policies so that only the GlobalProtect zone is allowed access to your data center resources and let everything else hit the interzone-default policy or a specific deny rule.

Re: Require authentication via global protect when connecting to data center resources

bhughesiii — Wed, 01 May 2019 16:40:02 GMT

@BPry

Thank you, I'll look into that. This is my first rodeo with Palo Alto and firewalls in general so somethings like this are slightly over my head.

Re: Require authentication via global protect when connecting to data center resources

Remo — Wed, 01 May 2019 19:31:20 GMT

Hi @bhughesiii

For a start with paloalto you chose a challenging project 😉

What you are asking for is possible. To start with this read the following documents:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/map-ip-addresses-to-usernames-using-captive-portal/configure-captive-portal.html

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/authentication-policy-and-multi-factor-authentication-for-globalprotect

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/configure-globalprotect-to-facilitate-multi-factor-authentication-notifications.html

Depending on the authentication method and if you use MFA GlobalProtect will guide the user through the authentication process or display an URL that leads to the captive portal website where the user is required to authenticate.

Hope this helps.

Regards,

Remo

Re: Require authentication via global protect when connecting to data center resources

bhughesiii — Wed, 01 May 2019 19:55:50 GMT

@Remo,

Yes it is a pretty big challenege. I'm familiar with most of Palo Alto as I spent my first couple of months in this job diving in and learning our setup and getting familiar with the device. We intend to use freeRADIUS, which we use for authenticating admin access into our devices, for the 2FA portion.

thanks for those links, I'll be diving into them shortly.