Local user authentication

[peterpan13888]

Hi all,

What does it mean if I create a rule that allows http/https services only for authenticated users from local user database between 2 zones? Will the users have to authenticate to the firewall first? How?

Thanks!

Peter 

[Phoenix]

Hello Peter,

Authenticating to the firewall works on the firewall management interface and we do not create rules for this interface.

The rules created are for data ports. If a user is traversing through the PAN between 2 zones and the security rule has http and https only allowed as services then that user can only pass port 80 and 443 traffic between the zones.

Thanks

[kadak]

Hello Peter,

Firewall administration (logging and authenticating to the firewall to gain WebUi and CLI access) is done under Device > Administrators. We need to manually add administrators.

If a user-ip mapping comes to the firewall with a username matched to the one in the local database, then traffic would hit that rule allowing http/https service. One scenario you could think of if by using local database as authentication profile in global protect. It really boils down to where you are using local database as an authentication profile on your Palo Alto firewall.

Regards,

Kunal Adak

[hshah]

Hi peterpan13888,

In policy there are only 4 options to configure users "any", "known", "unknown" and "select".

As per my knowledge there is no option to configure policy for "local user database", because "local user database" is design only firewall authentication.

Please provide me more information how did you configure "local user database in policy". I would appreciate if you can share few screen shots.

Regards,

Hardik Shah

[peterpan13888]

Actually I am trying to migrate some rules in Juniper firewall and found two that cannot be migrated which allow only locally authenticated users to connect between 2 zones. I just wonder how I can implement the same rules in PA?

[ExclusiveNetworksGermany]

Create a Policy between the two zones for "known User" or if you like specific named User. This Policy will only match for authenticated Users.

Create Local User Accounts, (you can also use AD User)

Create a Captive Portal Policy

How to Configure Captive Portal

Cheers

Marco