Require authentication via global protect when connecting to data center resources

[bhughesiii]

In an attempt to secure connections to production resources. I would like to implement a policy that if you are for instance using SSMS to connect from one location to a database in the data center, that you first have to authenticate via global protect client using two factor authentication before you can connect to said resource.

any guidance would be greatly appreciated and any requests for more information will be answered as quickly as I can.

Thank you

[BPry]

@bhughesiii,

Usually GlobalProtect connections are terminated in their own zone on the firewall. If that's the case in your environment, you would simply modify the existing security policies so that only the GlobalProtect zone is allowed access to your data center resources and let everything else hit the interzone-default policy or a specific deny rule.

[bhughesiii]

@BPry 

Thank you, I'll look into that. This is my first rodeo with Palo Alto and firewalls in general so somethings like this are slightly over my head.

[Remo]

Hi @bhughesiii 

For a start with paloalto you chose a challenging project 😉

What you are asking for is possible. To start with this read the following documents:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/map-ip-a...

https://docs.paloaltonetworks.com/pan-os/8-0/pan-os-new-features/globalprotect-features/authenticati...

https://docs.paloaltonetworks.com/globalprotect/8-1/globalprotect-admin/authentication/configure-glo...

Depending on the authentication method and if you use MFA GlobalProtect will guide the user through the authentication process or display an URL that leads to the captive portal website where the user is required to authenticate.

Hope this helps.

Regards,

Remo

[bhughesiii]

@Remo,

Yes it is a pretty big challenege. I'm familiar with most of Palo Alto as I spent my first couple of months in this job diving in and learning our setup and getting familiar with the device. We intend to use freeRADIUS, which we use for authenticating admin access into our devices, for the 2FA portion.

thanks for those links, I'll be diving into them shortly.