Web Authentication

Reply
L1 Bithead

Web Authentication

On our juniper firewalls we are using web authentication to restrict access to certain hosts and I would like to know if this is possible and how to on PA.

 

The user hits a captive portal(webauth in juniper) that is boudn to an interface:

set interfaces reth0 unit xxxx family inet address x.x.x.x/24 web-authentication https

This presents a simple login page that requries two factor authentication wich then puts an entry into a local database. A policy then allows the traffic based on this.

set security policies from-zone aaaa to-zone bbbb policy test match source-address subnetx
set security policies from-zone aaaa to-zone bbbb policy test match destination-address web-auth-hosts
set security policies from-zone aaaa to-zone bbbb policy test match application junos-https
set security policies from-zone aaaa to-zone bbbb policy test then permit firewall-authentication web-authentication

 

Authentication Profile

set access profile TEST-ACCESS authentication-order radius
set access profile TEST-ACCESS session-options client-idle-timeout 10
set access profile TEST-ACCESS session-options client-session-timeout 120
set access profile TEST-ACCESS radius-server x.x.x.x port 1812
set access firewall-authentication web-authentication default-profile TEST-ACCESS
set access firewall-authentication web-authentication banner success "TEST Access Login Successful"

Community Manager

Re: Web Authentication

You can do this on the Palo Alto too, it might work a little different than your Juniper setup however

 

create an authentication profile, enable captive portal, set a captive portal policy to intercept connections going to your server, set security policy to only allow access to identified users

 

here's how to setup captive portal

a little more info on the different modes (you'll need web-form)

and the "getting started: User-ID" guide if you'd like to know more about how it all works

 


Help the community: Like helpful comments and mark solutions
Reaper out
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!