- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
08-27-2013 04:15 AM
Hi All,.
Is it possible to create AD group based authentication for PaloAlto administrators?
If yes, kindly provide the steps for the same.
Regards,
Gururaj
08-27-2013 05:02 AM
Hi,
If your question is about using a group instead of users for admin, answer is no .... not yet
Else for sure you can group all your pa'sadmin in AD group and use all user in this group for defining admin profile and role.
What you have to do is to follow this doc: https://live.paloaltonetworks.com/docs/DOC-4740,create your admin account in the palo then assign them to admin role.
Hope help
V.
08-27-2013 06:55 AM
You can use Radius VSA to accomplish group permission for admin. Here's a doc on Radius VSA and configuration examples for Windows server: Radius Vendor Specific Attributes (VSA) .
Thanks.
08-27-2013 04:00 PM
If you are planning to use a group name under Device ---> administrator then it wont work
You have to user individual user names with LDAP as authentication profile.
Step1:
create LDAP profile
Device --> Server Profiles ---> LDAP
Step2:
Create authentication profile under Device --> Authentication Profiles
Step3:
Now select under Device --> administrator
Create an Administrator user. Make sure the user name is same as on the DC other wise the user will not able able to login.
Now commit the changes and the user will be able to login.
However if this is not feasible for you and you do not want to configure all you users here . You can also use Radius and set it with Admin Roles.
Here is a doc that explains how to do that.
https://live.paloaltonetworks.com/docs/DOC-1765
Hope this helps.
Thanks
Numan
08-27-2013 04:01 PM
Here is another doc which explains on how to setup LDAP authentication
https://live.paloaltonetworks.com/docs/DOC-2910
Let us know if this helps.
Thanks
Numan
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!