Authenticating GP users to Prisma Access with user certificates?

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Authenticating GP users to Prisma Access with user certificates?

L2 Linker

Hi folks,

We are currently using an LDAP auth profile to auth our GP clients to PA. This is working fine, but the portal logs are just swamped with brute force attacks day & night and PAN refuses to fix this, so we are wanting to move over to certificate authentication instead.

 

In brief, we have an AD-integrated MS PKI that issues user and machine certs via group policy. The machine certs are currently being used successfully to authenticate machines in a 'pre-logon' profile before the user logs in, so it would seem this is possible, but for the life of me I cannot figure out what is necessary to configure this for user auth through the Strata Cloud Manager (we do not use Panorama), and I'm completely unable to locate any PAN documentation describing this configuration process.

 

Can anyone here help?

Thanks very much!

4 REPLIES 4

L1 Bithead

Hi @LCMember40912 ,

 

There is a section called "copilot" in SCM can you paste you query to find out the configuration guidance meanwhile we are checking internally. 

 

husingh_0-1726167803413.png

 

L2 Linker

Hi, I do not have a 'Copilot' section in SCM. Thanks for your suggestion however.

L2 Linker

I'm going to suspend this topic. My goal in moving toward cert auth was to eliminate the flood of brute-force attacks against the portal. Turns out that won't help. The web portal can't be disabled, even if GP uses cert auth, so as long as the portal is up, people are free to brute force it to their heart's content and there's absolutely nothing you can do about it until PAN gets off their butt and address it. Really bad look for an erstwhile 'security' organization...

@LCMember40912  apology for the incovinience.

 

https://docs.paloaltonetworks.com/prisma-access/administration/prisma-access-mobile-users/enable-mob...

 

Please go though above document(Enable Mobile Users to Authenticate to Prisma Access).

This document has the available options to authenticate mobile users.

 

  • 396 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!