System Alert opaque: failed authentication for user ''. Reason: User is not in allowlist. auth profile 'GP', vsys 'vsys1', From: "public IP"

[roma]

Hi,

I've been receiving many system alerts with the message:

opaque: failed authentication for user ''. Reason: User is not in allowlist. auth profile '', vsys 'vsys1', From" "Public IP"

eventid: auth-fail

It looks like these public IP's are trying to access our internal network by coming through Global Protect App. Coming from many different random user names and public IP addresses. It seems that the Palo Alto firewall sends the credentials to the Active Directly Server and tharts when it fails.

Is there a way to prevent all these attempts without even having it go to the AD server?

Thanks.

[aleksandar.astardzhiev]

Hi @roma ,

The error message you receive actually tell the opposite - "Reason: User is not in allowlist"

When you configure your Authentication Profile, there is a tab to specify list of users or user groups that are allowed to authenticate with that profile.

Firewall will first take the provide username and compare it with this allow list. If it doesn't match any of the allowed users/user groups, FW will deny user authentication, without even sending the credentials to AD for validation

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/device/device-authentication-...