Authenticating GP users to Prisma Access with user certificates?

[LCMember40912]

Hi folks,

We are currently using an LDAP auth profile to auth our GP clients to PA. This is working fine, but the portal logs are just swamped with brute force attacks day & night and PAN refuses to fix this, so we are wanting to move over to certificate authentication instead.

In brief, we have an AD-integrated MS PKI that issues user and machine certs via group policy. The machine certs are currently being used successfully to authenticate machines in a 'pre-logon' profile before the user logs in, so it would seem this is possible, but for the life of me I cannot figure out what is necessary to configure this for user auth through the Strata Cloud Manager (we do not use Panorama), and I'm completely unable to locate any PAN documentation describing this configuration process.

Can anyone here help?

Thanks very much!

[husingh]

Hi @LCMember40912 ,

There is a section called "copilot" in SCM can you paste you query to find out the configuration guidance meanwhile we are checking internally. 

[LCMember40912]

Hi, I do not have a 'Copilot' section in SCM. Thanks for your suggestion however.

[LCMember40912]

I'm going to suspend this topic. My goal in moving toward cert auth was to eliminate the flood of brute-force attacks against the portal. Turns out that won't help. The web portal can't be disabled, even if GP uses cert auth, so as long as the portal is up, people are free to brute force it to their heart's content and there's absolutely nothing you can do about it until PAN gets off their butt and address it. Really bad look for an erstwhile 'security' organization...

[husingh]

@LCMember40912  apology for the incovinience.

https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-mobile-users/enable-mob...

Please go though above document(Enable Mobile Users to Authenticate to Prisma Access).

This document has the available options to authenticate mobile users.

[VTQNetwork]

Yeah, I have the same problem with brute force.

It’s possible to deny the traffic by country, but not by the source IP.

With Allow Lists you can prevent sending brute force logins to your AD, but you will continue to see the logs.

AFAIK, it’s not possible to configure security policy on the internet-portal traffic neither block by source IP address.

[LCMember40912]

"It’s possible to deny the traffic by country, but not by the source IP."

No, you can put subnets as well as regions in the embargo list...

[VTQNetwork]

Interesting - do you have positive results with blocking /32 „subnets”?

I’ve added my own IP address to the working embargo policy but I was still able to access both Portal & Gateways.

[LCMember40912]

Yes. Check logs for failed username and passwords, add the source IP's\ranges to the embargo and watch them disappear.