Time-Based Access Restriction and Password Expiration for Local Users

[SamuelKas]

Hello Palo Alto Community Team,

I need your assistance with configuring local user accounts on a Palo Alto Networks firewall.

My requirements are:

1. Configure time-based access restrictions for specific local users. For example, allow a user to log in only during a specified time period (such as Monday–Friday, 8:00 AM to 5:00 PM).
2. Configure password expiration for each local user so that users are required to change their password after a defined number of days.

Could you please advise:

• Whether these features are supported for local users on the Palo Alto firewall?
• If supported, what is the recommended configuration procedure?
• If these features are not available for local users, what is the recommended alternative (for example, using LDAP, Active Directory, or another authentication method)?

Thank you for your support.

Kind regards,

[Raido_Rattameister]

You can attach "Password Profile" to locally configured administrators.

This fills password change requirement.

Assuming you have segmented network where those admins source from LAN or GlobalProtect zone and reach to MGMT zone for Palo management (admin to Palo traffic passes Palo dataplane) then you can simply create security policy with "Schedule" attached to it (can be configured on Actions tab) to specify time window when those sessions are permitted.