SAML for external admin, local admin for internal admin

[NineMasts]

Hi, been racking my brain trying to figure this one out.

Essentially, to comply with regional guidelines for our client, we are enforcing MFA for all administrative accounts on the Palo Altos, which are internet facing. 

I have implemented SAML authenticating with Azure AD with Microsoft Authenticator for 2FA, which is all fine and well, and I am ready to delete the local admin accounts but surely that's really risky, in case the firewall has an issue with reaching the idp or something else happens, then it's a total lockout.

Is there a way of allowing ONLY SAML login from external whitelisted IP addresses (I assume managed with Interface Mgmt under Network), but allow a local admin account access to Panorama from, say, a specific internal interface such as Management?

Thanks in advance!

[florence023]

---

@NineMasts wrote:

Hi, been racking my brain trying to figure this one out.

Essentially, to comply with regional guidelines for our client, we are enforcing MFA for all administrative accounts on the Palo Altos, which are internet facing. 

I have implemented SAML authenticating with Azure AD with Microsoft Authenticator for 2FA, which is all fine and well, and I am ready to delete the local admin accounts but surely that's really risky, in case the firewall has an issue with reaching the idp or something else happens, then it's a total lockout. Spotify Pie

Is there a way of allowing ONLY SAML login from external whitelisted IP addresses (I assume managed with Interface Mgmt under Network), but allow a local admin account access to Panorama from, say, a specific internal interface such as Management?

Thanks in advance!

---

Hello,

To achieve your desired setup, you can follow these steps:

SAML Authentication for External Access:
Configure SAML authentication for external users (administrators) accessing the Palo Alto Networks firewall.
Ensure that your SAML setup with Azure AD and Microsoft Authenticator is working as expected.
Whitelisted IP Addresses for SAML:
Apply the Interface Management profile to the external-facing interface (e.g., ethernet1/3):
Go to Network > Interfaces > Ethernet.
Click on the interface name (e.g., ethernet1/3).
Under the Advanced tab, select the Management Profile as Remote_management.
Click OK and commit the changes.
Local Admin Access via Specific Internal Interface (e.g., Management):
For local admin access (e.g., Panorama), allow it only from a specific internal interface (e.g., Management):
Use security policies to restrict access based on source IP addresses.
Create a policy that allows traffic from the internal interface (Management) to the desired services (e.g., Panorama).
Ensure that this policy is placed before any other more permissive policies.
By following these steps, you’ll allow SAML login from external whitelisted IPs while still allowing local admin access via the specified internal interface. Remember to thoroughly test your setup before enforcing it in production.

Hope this will help you.
Best regards,
florence023

[reaper]

@florence023 

IMHO applying an interface management profile to the untrusted interface is a _really_ bad idea

This also does not resolve the question, any admin profile/mgt interface will allow both SAML and local accounts, so if you want you can have both at the same time

@NineMasts 

What I would recommend is to have a breakglass admin account: all admins get a SAML account and one local admin account is created with a 'secret' password so no one uses it unless there is an emergency that breaks SAML (in which case the password is retrieved from the vault and admins can log in with the breakglass account)

in addition you can set up a log forwarding profile with a filter for that username so if someone does log in with that breakglass account while there's no emergency, you are notified