In an attempt to secure connections to production resources. I would like to implement a policy that if you are for instance using SSMS to connect from one location to a database in the data center, that you first have to authenticate via global protect client using two factor authentication before you can connect to said resource.
any guidance would be greatly appreciated and any requests for more information will be answered as quickly as I can.
Usually GlobalProtect connections are terminated in their own zone on the firewall. If that's the case in your environment, you would simply modify the existing security policies so that only the GlobalProtect zone is allowed access to your data center resources and let everything else hit the interzone-default policy or a specific deny rule.
For a start with paloalto you chose a challenging project ;)
What you are asking for is possible. To start with this read the following documents:
Depending on the authentication method and if you use MFA GlobalProtect will guide the user through the authentication process or display an URL that leads to the captive portal website where the user is required to authenticate.
Hope this helps.
Yes it is a pretty big challenege. I'm familiar with most of Palo Alto as I spent my first couple of months in this job diving in and learning our setup and getting familiar with the device. We intend to use freeRADIUS, which we use for authenticating admin access into our devices, for the 2FA portion.
thanks for those links, I'll be diving into them shortly.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!