Palo Alto - Security rules best practice for web filtering delegation

[O.ELHANCHI]

Hi,

We deploy multiple PA-220 and configure them through a unified Panorama. 

The need is to provide local administrators with the ability to manage a part of the web filtering to do things like add/remove a website from the allow/blocklist URL category that has been defined locally.

The biggest challenge to us, is in the way Palo Alto handles object configuration from Panorama to the local device. 

Essentially when having a rule that filters web traffic with an URL filtering object that has been defined on the Device Group level, then afaik there is no way for the local administrator to temper with that object, in order to add / remove some URL categories in there for instance.

This is of course a major security benefit but it also comes at the cost of practicality in the particular case where delegation matters. 

So the way we handle this for now, is that we create a local rule on each PA-220, and since all our Panorama rules are POST it takes precedence over it. 

This way we can assign locally created URL categories to it, and give the local administrators the ability to add/block websites without the need of our intervention. 

The problem with this is that it breaks the point of having a Panorama for web traffic, which is a tremendous part of the network, AND most importantly whenever the client policy changes for instance to block a particular category that was previously allowed, we would need to change that category on every single device manually. 

I am curious what is the proper take on this and how should web-traffic be considered in regards to these delegation purposes.

Thank you,

[PavelK]

Hello @O.ELHANCHI

have you looked into Access Domains feature in Panorama: Access Domains? With Access Domains you can customize to what Device Group an administrator has access to. If you combine it with custom role (Sample here ), you can set a granular RBAC for your administrators to let them make changes from Panorama instead of doing it locally. You as a main admin can still review and audit all changes centrally from Panorama.

Kind Regards

Pavel

[O.ELHANCHI]

Hi, 

Indeed we are aware of this option, however it is not possible in our use case since the access to the remote network hosting the Panorama is not allowed from the branch sites. 

Consequently, local administrators are not enabled to interact with the Panorama as a result of this network restriction.

Thank you for your reply