Web Authentication

[r24481]

On our juniper firewalls we are using web authentication to restrict access to certain hosts and I would like to know if this is possible and how to on PA.

The user hits a captive portal(webauth in juniper) that is boudn to an interface:

set interfaces reth0 unit xxxx family inet address x.x.x.x/24 web-authentication https

This presents a simple login page that requries two factor authentication wich then puts an entry into a local database. A policy then allows the traffic based on this.

set security policies from-zone aaaa to-zone bbbb policy test match source-address subnetx
set security policies from-zone aaaa to-zone bbbb policy test match destination-address web-auth-hosts
set security policies from-zone aaaa to-zone bbbb policy test match application junos-https
set security policies from-zone aaaa to-zone bbbb policy test then permit firewall-authentication web-authentication

Authentication Profile

set access profile TEST-ACCESS authentication-order radius
set access profile TEST-ACCESS session-options client-idle-timeout 10
set access profile TEST-ACCESS session-options client-session-timeout 120
set access profile TEST-ACCESS radius-server x.x.x.x port 1812
set access firewall-authentication web-authentication default-profile TEST-ACCESS
set access firewall-authentication web-authentication banner success "TEST Access Login Successful"

[reaper]

You can do this on the Palo Alto too, it might work a little different than your Juniper setup however

create an authentication profile, enable captive portal, set a captive portal policy to intercept connections going to your server, set security policy to only allow access to identified users

here's how to setup captive portal

a little more info on the different modes (you'll need web-form)

and the "getting started: User-ID" guide if you'd like to know more about how it all works