How Do You Authenticate Users From Specific IP Ranges for Admin Device Access?

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L2 Linker

How Do You Authenticate Users From Specific IP Ranges for Admin Device Access?

Palo Alto integrates with a number of products; which usually require specific user accounts on the firewall. If your firewall has management access exposed to the internet all of the accounts can be used to log into the firewall. Would it be possible to limit device management for certain users access to specific subnets, such as RFC 1918? 

 

Example 1: Joe can log in an manage the firewall from inside the network and from the internet. Sally can only manage the firewall from the 10.10.10.0/24 network.

 

Example 2: Joe_Admin has admin device access on the internal network. Joe logs in externally as Joe_RO which has read only access externally while Joe cannot login as Joe_Admin externally. 

 

The end goal is to limit the accounts exposed to the internet. I do understand it would be possible not expose external access and use Global Protect  (client and clientless) to to login from an internal subnet, but that is not currently an option.

Highlighted
L4 Transporter

@blwavg You answered the question in your description, this can easily be achieved by using Global Protect and you shlould never really be exposing unprotected admin access to internet. 

 If you are using UserID and dynamic admin authentication, you can potentially create granular access policies for the internal network as you described. However you cannot do it from internet, as the firewall will need to know the user to ip mapping for the specific admin and the Internet admin can have any IP. 

Highlighted
L2 Linker

Hey @BatD 

 

Thank you for your time to response. I am currently asking for alternative methods for limiting access that do not include global protect. I will modify my original ask to make sure that was clear. 

Highlighted
L4 Transporter

@blwavg The users need to be identified somehow at policy level, and the other option is to use Authentication Policy (preciously known as Captive Portal)  to grant access to the firewall management. This will allow you to configure very granular control of which use can manage the firewall from particular subnet. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!