authentication question for device login.

[willstech]

Hello there

i have two questions and the question are  2-factor auth and AD users for device login. .

1. firest question is related to 2 factor auth.

   i heard that it is possible to apply 2-factor authentication with OTP for PAN device login.

   Does other authentication systems also available for 2-factor authentication? for example  RADIOUS, LDAP and etc.

   if it is possible to implement 2-factor auth without OTP, what kind of auth systems is available to apply its 2-factor auth?

2. AD user for PAN device login

    Does AD users can login PAN device as AD user permission?

   For example,

   Users of AD admin group can login PAN device as full permission.

   But, operator group of AD should login PAN device as read-only permission

Definitely, it is not local user group of PAN device.

Please let me know how I can have a configuration if it is possible.

[schiang1 · Accepted solution]

1. two factor authentication OTP solutions would be supported by the PAN via RADIUS. As far as two auth without OTP, if you have PKI in your environment you could use smartcards or certificates with private key password protected.

2. create two auth profiles,one with the AD admin user group in the allow list and the other with the operator AD user group in the allow list.  Then create two administrators using one of the auth profiles and select the appropriate admin role (i.e. superuser or read-only)