Require authentication via global protect when connecting to data center resources

Reply
L1 Bithead

Require authentication via global protect when connecting to data center resources

In an attempt to secure connections to production resources. I would like to implement a policy that if you are for instance using SSMS to connect from one location to a database in the data center, that you first have to authenticate via global protect client using two factor authentication before you can connect to said resource.

 

any guidance would be greatly appreciated and any requests for more information will be answered as quickly as I can.

 

 

Thank you

L7 Applicator

Re: Require authentication via global protect when connecting to data center resources

@bhughesiii,

Usually GlobalProtect connections are terminated in their own zone on the firewall. If that's the case in your environment, you would simply modify the existing security policies so that only the GlobalProtect zone is allowed access to your data center resources and let everything else hit the interzone-default policy or a specific deny rule.

 

Highlighted
L1 Bithead

Re: Require authentication via global protect when connecting to data center resources

@BPry 

 

Thank you, I'll look into that. This is my first rodeo with Palo Alto and firewalls in general so somethings like this are slightly over my head.

L7 Applicator

Re: Require authentication via global protect when connecting to data center resources

Hi @bhughesiii 

 

For a start with paloalto you chose a challenging project ;)

What you are asking for is possible. To start with this read the following documents:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/map-ip-a...

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/authenticati...

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/configure-glo...

 

Depending on the authentication method and if you use MFA GlobalProtect will guide the user through the authentication process or display an URL that leads to the captive portal website where the user is required to authenticate.

 

Hope this helps.

Regards,

Remo

 

L1 Bithead

Re: Require authentication via global protect when connecting to data center resources

@vsys_remo,

 

Yes it is a pretty big challenege. I'm familiar with most of Palo Alto as I spent my first couple of months in this job diving in and learning our setup and getting familiar with the device. We intend to use freeRADIUS, which we use for authenticating admin access into our devices, for the 2FA portion.

 

thanks for those links, I'll be diving into them shortly.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!