Is it possible to create AD group based authentication for PaloAlto administrators?

[Gururaj]

Hi All,.

Is it possible to create AD group based authentication for PaloAlto administrators?

If yes, kindly provide the steps for the same.

Regards,

Gururaj

[VinceM]

Hi,

If your question is about using a group instead of users for admin, answer is no .... not yet

Else for sure you can group all your pa'sadmin in AD group and use all user in this group for defining admin profile and role.

What you have to do is to follow this doc: https://live.paloaltonetworks.com/docs/DOC-4740,create your admin account in the palo then assign them to admin role.

Hope help

V.

[rmonvon]

You can use Radius VSA to accomplish group permission for admin.  Here's a doc on Radius VSA and configuration examples for Windows server: Radius Vendor Specific Attributes (VSA) .

Thanks.

[mbutt]

If you are planning to use a group name under Device ---> administrator then it wont work

You have to user individual user names with LDAP as authentication profile.

Step1:

create LDAP profile

Device --> Server Profiles ---> LDAP

Step2:

Create authentication profile under Device --> Authentication Profiles

Step3:

Now select under Device --> administrator

Create an Administrator user. Make sure the user name is same as on the DC other wise the user will not able able to login.

Now commit the changes and the user will be able to login.

However if this is not feasible for you and you do not want to configure all you users here . You can also use Radius and set it with Admin Roles.

Here is a doc that explains how to do that.

https://live.paloaltonetworks.com/docs/DOC-1765

Hope this helps.

Thanks

Numan

[mbutt]

Here is another doc which explains on how to setup LDAP authentication

https://live.paloaltonetworks.com/docs/DOC-2910

Let us know if this helps.
Thanks

Numan