Require authentication via global protect when connecting to data center resources

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Require authentication via global protect when connecting to data center resources

L1 Bithead

In an attempt to secure connections to production resources. I would like to implement a policy that if you are for instance using SSMS to connect from one location to a database in the data center, that you first have to authenticate via global protect client using two factor authentication before you can connect to said resource.

 

any guidance would be greatly appreciated and any requests for more information will be answered as quickly as I can.

 

 

Thank you

4 REPLIES 4

Cyber Elite
Cyber Elite

@bhughesiii,

Usually GlobalProtect connections are terminated in their own zone on the firewall. If that's the case in your environment, you would simply modify the existing security policies so that only the GlobalProtect zone is allowed access to your data center resources and let everything else hit the interzone-default policy or a specific deny rule.

 

@BPry 

 

Thank you, I'll look into that. This is my first rodeo with Palo Alto and firewalls in general so somethings like this are slightly over my head.

Hi @bhughesiii 

 

For a start with paloalto you chose a challenging project 😉

What you are asking for is possible. To start with this read the following documents:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/map-ip-a...

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/authenticati...

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/configure-glo...

 

Depending on the authentication method and if you use MFA GlobalProtect will guide the user through the authentication process or display an URL that leads to the captive portal website where the user is required to authenticate.

 

Hope this helps.

Regards,

Remo

 

@Remo,

 

Yes it is a pretty big challenege. I'm familiar with most of Palo Alto as I spent my first couple of months in this job diving in and learning our setup and getting familiar with the device. We intend to use freeRADIUS, which we use for authenticating admin access into our devices, for the 2FA portion.

 

thanks for those links, I'll be diving into them shortly.

  • 2978 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!