Is panorama able to see only the devices in their country with RO access.

[RomainCouvreur]

Hello Community,

Customer has 2 Panorama devices in A/P. They have devices on boarded to panorama. The requirement is the specific country will be able to see only the devices in their country with RO access.

The Authentication method will be SAML with SSO.

Could you please suggest how this could be fulfilled and how many Metadata files and certificates will be required ?

Do they need multiple SAML Identity provider and authentication profile configured ?

Do they need to assign admin role and access-domain to each authentication profile ?

Do they need to add them in sequence in the Panorama--> Management---> Authentication ?

They checked following guide :

Identity Provider Configuration for SAML
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UXP
Configure SAML Authentication for Panorama Administrators
https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/set-up-panorama/set-up-administrative...

Customer has to provide individual country access to their specific set of firewalls. So they have to create multiple access domain for them.

If they go by the document then they have to create multiple authentication profile and add access domain to that.

In panorama management setting they can only add a single authentication profile.

Also if they add multiple authentication profile per country how many SAML IDP profile they have to create?

How many SAML metadata file we need?

How to attach multiple authentication profile to panorama management setting?

Authentication sequence does not work properly here as per their past experience.

Really i m not sure if country-based access control to Panorama is possible.

I think that Panorama cannot filter it but i don't know if we could with the SAML idp.

Many thanks in advance for your reply.

Best regards