Authenticating external users to firewall like Sonicwall?

[SmartEdgeJC]

Hi all,

I am configuring a PA-500 for a POC exercise with a customer who is currently using a Sonicwall.

While there are obviously other/better ways to accomplish this and I realize how silly this is, given the limited scope I'm presently working in, I need to find a way to replicate a feature they presently "require".

In Sonicwall world, a user outside the corporate network can browse to the WAN IP of the firewall and log in with their credentials to become a "Trusted User" on the firewall.  A firewall rule applying only to "Trusted Users" then allows them to RDP to a different IP in their /28 which gets NAT-ed through to a Remote Desktop server on the inside.  Kind of a "Captive Portal in reverse", I guess.

Is there any way to replicate this functionality as closely as possible in PAN world??

Many thanks!

--jeff

[SmartEdgeJC]

I imagine that if they buy this thing after the POC that they'll be deploying GP, but sadly for now I have to figure out how to do this without otherwise it isn't going to fly......................

[SmartEdgeJC]

The use case here is for some employees with Macs to be able to log into the terminal server from home.  I'm told that connecting a Mac to a Sonicwall can be a pain in the backside.  Obviously GP works on OS X, and I bet the built in VPN client would work fine as well... but the preference at this point is to rock the boat as little as possible to get the blue device in the door.

I considered throwing it in in vwire mode but one of their pain points is how pokey the Sonicwall is with all the security features turned on.

[Ameya-Kawimandan]

VWIRE mode with following settings should be a good way to start.

1> All the tags allowed 0-4094

2>Non-Syn-tcp-reject  turned off

3>assymetric bypass tuned on

These settings would ensure that PA  functions as a transparent device, staying inline.

Security features can be selectively turned on an ad hoc basis.

-HTH...!