Authenticating Panorama users with AD

[robert.b]

Is it possible to authenticate users using their AD credentials when they log into Panorama? Short of giving administrators their own login into Panorama, I'm unable to track who has changed what.

I've read through the LDAP guide, but it focuses on the actual security devices and not Panorama.

Has anyone done this or know if it is possible?

Thanks

[mharding]

Yes, but you'll need a RADIUS server. You'll add the Panorama to the RADIUS clients using the RADIUS standard client-vendor attributes. Then create a strong password for the shared secret. Write that down, and we'll come back to that next.

Then you'll need to add the RADIUS policies. For a Windows RADIUS server, we use the "Client Friendly Name Matches" and use the name of the RADIUS client you just added, and "Windows-Groups matches" for the group of users you want to authenticate.

Then click on the "Edit Profile" button. Under the authentication tab, check everything but "Encrypted authentication (CHAP)" and "Allows clients to connect without negotiation an authenticate method."

Then stop and start the RADIUS server.

Then create a RADIUS profile in Panorama. Added the IP address of the RADIUS server and enter to shared secret you assigned for that server. Then you should be able to add the administrative user's short name, and select the checkbox for RADIUS authentication. Commit the change and try it out.

I think that's everything we had to do to make it work.

[robert.b]

Thanks, I'll see if we can get the Windows IAS installed.

Pity it can't just use LDAP!

[mharding]

If it can, I haven't bothered. We set it up before PAN OS 3.1.

[mjacobsen]

You should be able to use LDAP directly for checking the account credentials but you would still need to setup the admin accounts within Panorama as it will only use the LDAP connection for checking the password. If you want to avoid setting up the accounts explicitly, you can use RADIUS VSAs to have Panorama (or the device) leverage directory information to determine which accounts should have access to the system (and what level of access).

Mike

[jhickey]

Mike, I cant get this to work. I set up AD Admin auth just like it is setup on my firewalls. I get invalid username/password.

[jhickey]

nevermind I got it.. DN of the id to query AD had a syntax error.