Who rated this post

---

@NineMasts wrote:

Hi, been racking my brain trying to figure this one out.

Essentially, to comply with regional guidelines for our client, we are enforcing MFA for all administrative accounts on the Palo Altos, which are internet facing. 

I have implemented SAML authenticating with Azure AD with Microsoft Authenticator for 2FA, which is all fine and well, and I am ready to delete the local admin accounts but surely that's really risky, in case the firewall has an issue with reaching the idp or something else happens, then it's a total lockout. Spotify Pie

Is there a way of allowing ONLY SAML login from external whitelisted IP addresses (I assume managed with Interface Mgmt under Network), but allow a local admin account access to Panorama from, say, a specific internal interface such as Management?

Thanks in advance!

---

Hello,

To achieve your desired setup, you can follow these steps:

SAML Authentication for External Access:
Configure SAML authentication for external users (administrators) accessing the Palo Alto Networks firewall.
Ensure that your SAML setup with Azure AD and Microsoft Authenticator is working as expected.
Whitelisted IP Addresses for SAML:
Apply the Interface Management profile to the external-facing interface (e.g., ethernet1/3):
Go to Network > Interfaces > Ethernet.
Click on the interface name (e.g., ethernet1/3).
Under the Advanced tab, select the Management Profile as Remote_management.
Click OK and commit the changes.
Local Admin Access via Specific Internal Interface (e.g., Management):
For local admin access (e.g., Panorama), allow it only from a specific internal interface (e.g., Management):
Use security policies to restrict access based on source IP addresses.
Create a policy that allows traffic from the internal interface (Management) to the desired services (e.g., Panorama).
Ensure that this policy is placed before any other more permissive policies.
By following these steps, you’ll allow SAML login from external whitelisted IPs while still allowing local admin access via the specified internal interface. Remember to thoroughly test your setup before enforcing it in production.

Hope this will help you.
Best regards,
florence023