Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Who Me Too'd this topic

How Do You Authenticate Users From Specific IP Ranges for Admin Device Access?

L2 Linker

Palo Alto integrates with a number of products; which usually require specific user accounts on the firewall. If your firewall has management access exposed to the internet all of the accounts can be used to log into the firewall. Would it be possible to limit device management for certain users access to specific subnets, such as RFC 1918? 

 

Example 1: Joe can log in an manage the firewall from inside the network and from the internet. Sally can only manage the firewall from the 10.10.10.0/24 network.

 

Example 2: Joe_Admin has admin device access on the internal network. Joe logs in externally as Joe_RO which has read only access externally while Joe cannot login as Joe_Admin externally. 

 

The end goal is to limit the accounts exposed to the internet. I do understand it would be possible not expose external access and use Global Protect  (client and clientless) to to login from an internal subnet, but that is not currently an option.

Who Me Too'd this topic