AD group for administratoin using authentication through LDAP

[TheOriginalgiga]

I'm trying to authenticate an AD group for administrative access for our PA. I'm missing the last step to implement it and I may have some of the steps messed up. could someone fill in the blanks for me?

1. Create an LDAP profile
2. Create an authentication profile
3. ???

Sorry if this question has been covered before.

Thanks

[goku123]

#3. Create an administrator under Device>administrators and assign the auth profile from #2 to the user.

[TheOriginalgiga]

In the administrator section, can I use the AD group name (such as "firewall Admins") or will it have to be per individual user within that group?

[goku123 · Accepted solution]

It would be per user.

If you would like to use user groups on AD, then you can try to use RADIUS since with RADIUS, you can return attributes for authorization (which cannot be done with LDAP - hence each user has to be created on the firewall, assigned a role and authenticated remotely).

Here is a document describing the configuration for RADIUS with VSA for your reference: https://live.paloaltonetworks.com/docs/DOC-1765

[TheOriginalgiga]

thank you, exactly what I wanted to know.