What does it mean if I create a rule that allows http/https services only for authenticated users from local user database between 2 zones? Will the users have to authenticate to the firewall first? How?
Authenticating to the firewall works on the firewall management interface and we do not create rules for this interface.
The rules created are for data ports. If a user is traversing through the PAN between 2 zones and the security rule has http and https only allowed as services then that user can only pass port 80 and 443 traffic between the zones.
Firewall administration (logging and authenticating to the firewall to gain WebUi and CLI access) is done under Device > Administrators. We need to manually add administrators.
If a user-ip mapping comes to the firewall with a username matched to the one in the local database, then traffic would hit that rule allowing http/https service. One scenario you could think of if by using local database as authentication profile in global protect. It really boils down to where you are using local database as an authentication profile on your Palo Alto firewall.
In policy there are only 4 options to configure users "any", "known", "unknown" and "select".
As per my knowledge there is no option to configure policy for "local user database", because "local user database" is design only firewall authentication.
Please provide me more information how did you configure "local user database in policy". I would appreciate if you can share few screen shots.
Actually I am trying to migrate some rules in Juniper firewall and found two that cannot be migrated which allow only locally authenticated users to connect between 2 zones. I just wonder how I can implement the same rules in PA?
Create a Policy between the two zones for "known User" or if you like specific named User. This Policy will only match for authenticated Users.
Create Local User Accounts, (you can also use AD User)
Create a Captive Portal Policy
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!