On our juniper firewalls we are using web authentication to restrict access to certain hosts and I would like to know if this is possible and how to on PA.
The user hits a captive portal(webauth in juniper) that is boudn to an interface:
set interfaces reth0 unit xxxx family inet address x.x.x.x/24 web-authentication https
This presents a simple login page that requries two factor authentication wich then puts an entry into a local database. A policy then allows the traffic based on this.
set security policies from-zone aaaa to-zone bbbb policy test match source-address subnetx
set security policies from-zone aaaa to-zone bbbb policy test match destination-address web-auth-hosts
set security policies from-zone aaaa to-zone bbbb policy test match application junos-https
set security policies from-zone aaaa to-zone bbbb policy test then permit firewall-authentication web-authentication
set access profile TEST-ACCESS authentication-order radius
set access profile TEST-ACCESS session-options client-idle-timeout 10
set access profile TEST-ACCESS session-options client-session-timeout 120
set access profile TEST-ACCESS radius-server x.x.x.x port 1812
set access firewall-authentication web-authentication default-profile TEST-ACCESS
set access firewall-authentication web-authentication banner success "TEST Access Login Successful"
You can do this on the Palo Alto too, it might work a little different than your Juniper setup however
create an authentication profile, enable captive portal, set a captive portal policy to intercept connections going to your server, set security policy to only allow access to identified users
here's how to setup captive portal
a little more info on the different modes (you'll need web-form)
and the "getting started: User-ID" guide if you'd like to know more about how it all works
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!