About Sly_Cooper

Hi,   I had configured Authentication policy for one of the environments and everything worked fine as expected. While replicating similar setup for a different environment, the Authentication policy was not working. After some troubleshooting, I observed that if the firewall has user to ip mapping generated via user-id agents (type UIA), it does not trigger Authentication policy (MFA, Type SSO). I confirmed the theory by doing multiple test with and without user-id agent config. How can I enforce Authentication Policy for already known user? I do not to remove the user-id agent config for the vsys as this environment is just a subset of the environments covered (same zone). I want users to perform MFA before accessing certain resources and not provide access based on user-id mapping (active directory logs).   I am running PAN-OS 9.0.x. Thanks in advance. ... View more

All,   I amtesting authentication policy for a certain project and was able to test it successfully with basic configuration. I am looking at a config where a single authentication policy could work across multiple vsys.   Scenario,   Firewall with multi-zone, one of the zones with web-server to intercept and redirect to the captive portal (with MFA). After successful authentication, the firewall will allow RDP access for the systems across multiple zone including non-web server zone. I have multiple environments running behind different vsys and would like to have a single authentication which would give access across multiple vsys. Is this possible? If yes then how? ... View more

Hi All,   I have successfully tested Authentication policy using LDAP, MFA (Okta API), SAML and RADIUS (Okta). I am working on the redundancy scenarios wherein if Okta fails, the fallback would be LDAP. I am using RADIUS (Okta) and LDAP in the Authentication Sequence. I am however unable to get the LDAP (Active Directory) fallback working. I am simulating RADIUS(OKTA) failure by configuring the service route to use the firewall traffic interface and then a security policy to block the RADIUS traffic. I can see that the firewall is successfully blocking RADIUS traffic. I however, want it to proceed to LDAP auth and authenticate considering RADIUS unavailability. I am using default-web-form in the auth policy and CP is set to use the authentication sequence. The authentication logs only show Authentication Failure with the RADIUS server events. What am I missing? Will this config ever work? ... View more

I am testing Captive Portal certificate authentication with enterprise PKI and it is not working. I have imported and configured cert profile using the enterprise root CA. When tried from the client machine, the request gets redirected to the captive portal page and asks for the client cert. Nothing happens when I select the client cert from the browser or the connection is reset over time. There are no logs generated under Authentication logs. How can I troubleshoot the issue? The captive portal is setup in a Redirect mode and the firewall intercepts requests and redirect to the required interface for authentication.  If I am using Certificate Authentication, then do I need to still utilize "Authentication Profile" under Captive Portal settings? ... View more