Authenticating GP users to Prisma Access with user certificates?

[LCMember40912]

Hi folks,

We are currently using an LDAP auth profile to auth our GP clients to PA. This is working fine, but the portal logs are just swamped with brute force attacks day & night and PAN refuses to fix this, so we are wanting to move over to certificate authentication instead.

In brief, we have an AD-integrated MS PKI that issues user and machine certs via group policy. The machine certs are currently being used successfully to authenticate machines in a 'pre-logon' profile before the user logs in, so it would seem this is possible, but for the life of me I cannot figure out what is necessary to configure this for user auth through the Strata Cloud Manager (we do not use Panorama), and I'm completely unable to locate any PAN documentation describing this configuration process.

Can anyone here help?

Thanks very much!

[husingh]

Hi @LCMember40912 ,

There is a section called "copilot" in SCM can you paste you query to find out the configuration guidance meanwhile we are checking internally. 

[LCMember40912]

Hi, I do not have a 'Copilot' section in SCM. Thanks for your suggestion however.

[LCMember40912]

I'm going to suspend this topic. My goal in moving toward cert auth was to eliminate the flood of brute-force attacks against the portal. Turns out that won't help. The web portal can't be disabled, even if GP uses cert auth, so as long as the portal is up, people are free to brute force it to their heart's content and there's absolutely nothing you can do about it until PAN gets off their butt and address it. Really bad look for an erstwhile 'security' organization...

[husingh]

@LCMember40912  apology for the incovinience.

https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-mobile-users/enable-mob...

Please go though above document(Enable Mobile Users to Authenticate to Prisma Access).

This document has the available options to authenticate mobile users.