Configure Cloud Identity Engine Authentication on the Firewall or Panorama
Table of Contents
Expand all | Collapse all
- Configure SCIM Connector for the Cloud Identity Engine
- Cloud Identity Engine Attributes
- Collect Custom Attributes with the Cloud Identity Engine
- View Directory Data
- Cloud Identity Engine User Context
- Create a Cloud Dynamic User Group
- Configure Third-Party Device-ID
- Configure an IP Tag Cloud Connection
- Configure a Client Certificate
- Set Up an Authentication Profile
- Configure Cloud Identity Engine Authentication on the Firewall or Panorama
- Configure the Cloud Identity Engine as a Mapping Source on the Firewall or Panorama
- Get Help
Configure Cloud Identity Engine Authentication on the Firewall or
After you Configure the Cloud Identity Engine as a Mapping Source on the Firewall or Panorama and Configure a SAML 2.0 Authentication Type, Configure a Client Certificate, or both, you can create an authentication profile that redirects users to the authentication type (either a client certificate or a SAML 2.0-compliant identity provider) you configure for authentication.
If you use Panorama to manage your firewalls, configure an authentication profile in Panorama then push the authentication profile to the managed firewalls.
Some steps in the following procedure are required only if you want to configure an authentication policy rule on the firewall using the Cloud Identity Engine and aren’t required if you want to authenticate administrators or to authenticate users with Prisma Access or GlobalProtect. These steps are indicated below.
- Configure an authentication profile to use the Cloud Authentication Service.
- On the firewall, select.DeviceAuthentication Profile
- Enter aNamefor the authentication profile.
- SelectCloud Authentication Serviceas theType.
- Select theRegionof your Cloud Identity Engine tenant.For more information on regions, refer to Activate the Cloud Identity Engine.
- Select the Cloud Identity EngineInstanceyou want to use for this authentication profile.For more information on Cloud Identity Engine tenants, refer to Cloud Identity Engine Tenants.
- Select an authenticationProfilethat specifies the authentication type you want to use to authenticate users.
- Specify theMaximum Clock Skew (seconds), which is the allowed difference in seconds between the system times of the IdP and the firewall at the moment when the firewall validates IdP messages (default is 60; range is 1–900). If the difference exceeds this value, authentication fails.
- SelectForce multi-factor authentication in cloudif your IdP is configured to require users to log in using multi-factor authentication (MFA).
- (Required for authentication policy rule only) Configure the Authentication Portal settings to use the authentication profile.
- Select.DeviceUser IdentificationAuthentication Portal Settings
- Editthe settings and select theAuthentication Profilefrom the first step.
- SelectRedirectas theMode.For more information on how to configure redirect mode, refer to Configure Authentication Portal.
- (Required for authentication policy rule only) Create an Authentication Enforcement object that uses the authentication profile to redirect users to log in using their authentication type.
- Addan Authentication Enforcement object and enter aNamefor the object.
- Selectweb-formas theAuthentication Method.
- Select theAuthentication Profilefrom the first step.
- (Optional) Enter aMessageto display to users.
- Create a URL list as a custom URL category to allow the necessary traffic for the Cloud Identity Engine.
- If you don’t need to strictly limit traffic to your region, you can enter*.apps.paloaltonetworks.com. Otherwise, determine your region-based URL using theshow cloud-auth-service-regionscommand to display the URLs for the region associated with your Cloud Identity Engine tenant and enter each region-based URL. The following table includes the URLs for each region:RegionCloud Identity Engine Region-Based URLUnited Statescloud-auth.us.apps.paloaltonetworks.comcloud-auth-service.us.apps.paloaltonetworks.comEuropecloud-auth.nl.apps.paloaltonetworks.comcloud-auth-service.nl.apps.paloaltonetworks.comUnited Kingdomcloud-auth.uk.apps.paloaltonetworks.comcloud-auth-service.uk.apps.paloaltonetworks.comSingaporecloud-auth.sg.apps.paloaltonetworks.comcloud-auth-service.sg.apps.paloaltonetworks.comCanadacloud-auth.ca.apps.paloaltonetworks.comcloud-auth-service.ca.apps.paloaltonetworks.comJapancloud-auth.jp.apps.paloaltonetworks.comcloud-auth-service.jp.apps.paloaltonetworks.comAustraliacloud-auth.au.apps.paloaltonetworks.comcloud-auth-service.au.apps.paloaltonetworks.comGermanycloud-auth.de.apps.paloaltonetworks.comcloud-auth-service.de.apps.paloaltonetworks.comUnited States - Governmentcloud-auth-service.gov.apps.paloaltonetworks.comcloud-auth.gov.apps.paloaltonetworks.comIndiacloud-auth-service.in.apps.paloaltonetworks.comcloud-auth.in.apps.paloaltonetworks.comSwitzerlandcloud-auth-service.ch.apps.paloaltonetworks.comcloud-auth.ch.apps.paloaltonetworks.comSpaincloud-auth-service.es.apps.paloaltonetworks.comcloud-auth.es.apps.paloaltonetworks.comItalycloud-auth-service.it.apps.paloaltonetworks.comcloud-auth.it.apps.paloaltonetworks.comFrancecloud-auth-service.fr.apps.paloaltonetworks.comcloud-auth.fr.apps.paloaltonetworks.comChinacloud-auth-service.cn.apps.prismaaccess.cncloud-auth.cn.apps.prismaaccess.cnThis region is only accessible in the Cloud Identity Engine within the specified region.Polandcloud-auth-service.pl.apps.paloaltonetworks.comcloud-auth.pl.apps.paloaltonetworks.comQatarcloud-auth-service.qa.apps.paloaltonetworks.comcloud-auth.qa.apps.paloaltonetworks.comTaiwancloud-auth-service.tw.apps.paloaltonetworks.comcloud-auth.tw.apps.paloaltonetworks.comIsraelcloud-auth-service.il.apps.paloaltonetworks.comcloud-auth.il.apps.paloaltonetworks.comIndonesiacloud-auth-service.id.apps.paloaltonetworks.comcloud-auth.id.apps.paloaltonetworks.com
- Enter the URLs that your IdP requires for user authentication (for example,*.okta.com).
- Create a security policy rule to allow traffic to the authentication type and Cloud Identity Engine and select the custom URL category as the match criteria.
- Create a internet management profile in the trusted zone and enable response pages.
- (Required for authentication policy rule only) Configure an Authentication policy rule to use the Authentication Enforcement object and allow traffic to the custom URL category.
- (Panorama only) If you use Panorama to manage multiple firewalls, configure the Cloud Identity Engine for Panorama.
- Select the Cloud Identity Engine authentication method you want to use with Panorama.
- To configure the Cloud Identity Engine in an authentication profile for managed devices, select.DeviceAuthentication Profile
- To use the Cloud Identity Engine in an authentication profile for Panorama administrators, select.PanoramaAuthentication Profile
- SelectandPanoramaSetupManagementEdittheAuthentication Settings, then select theAuthentication Profilefor the Cloud Identity Engine tenant you want to associate with Panorama.
- SelectandPanoramaDevice GroupsAddorEdita device group.
- Select theCloud Identity EngineandAddthe Cloud Identity Engine tenant you want to associate with Panorama then clickOK.
- Commityour changes and verify that the firewall redirects authentication requests to the Cloud Authentication Service.
- On the client device, use the browser to access a webpage that requires authentication.
- Confirm that the access request redirects to the Cloud Authentication Service.
- Enter your credentials to log in.