Set Up Pre-Logon for Prisma Access Agent

Table of Contents

Configure a Certificate to Decrypt the Authentication Override Cookie (Panorama Managed NGFW)

Set Up Pre-Logon for Prisma Access Agent

Complete the Cloud Identity Engine settings and configure pre-logon for Prisma Access Agent.

Where Can I Use This?	What Do I Need?
Prisma Access (Managed by Strata Cloud Manager)	Check the prerequisites for the deployment you're using Minimum required Prisma Access Agent version: 25.3 macOS or Windows desktop devices Contact your Palo Alto Networks account representative to activate the Prisma Access Agent feature

To set up pre-logon for Prisma Access Agents, you need to install the root certificate for signing client certificates in Cloud Identity Engine. Then, configure the pre-logon settings in the Agent Settings and set up security policy rules for pre-logon users in Strata Cloud Manager.

Before you begin to configure pre-logon, you need to complete the prerequisites on the endpoints.

Complete the following steps to configure pre-logon for Prisma Access Agents:

In Cloud Identity Engine, install the root certificate for signing client certificates, which signs the machine hostname of the endpoint.
1. Add a certificate to the CA Chains as follows:
  Select CA ChainsAdd CA Chain.
  Enter the name for the new CA Chain in CA Name.
  
  Drag and drop the certificate to Upload Certificate and Submit.
2. Add an authentication type for the CA chain you added.
  Select Authentication TypesAdd New Authentication Type.
  Set Up an authentication type for the client certificate.
  
  Enter a meaningful name for the Authentication Type Name.
  Add CA Chain and select the CA chain that you added in step 1.a and Submit.
3. Add an authentication profile for the authentication type that you created for the client certificate.
  Select Authentication ProfilesAdd Authentication Profile.
  Enter a meaningful PROFILE NAME.
  Choose the Single authentication mode.
  Select the authentication type that you created in step 1.b.
  Select User Principal Name for the Directory Sync Username Attribute.
  Select Common-Name for the Directory Sync Group Attribute.
  Submit.
Configure the user authentication settings in Strata Cloud Manager.
1. Go to ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
2. Add User Authentication.
3. Select the following options:
  Authenticate Users From—Select Match Any.
  Authentication Type—Select Client Certificate, Client Certificate OR SAML, or Client Certificate AND SAML.
  Certificate Profile—Select the certificate profile created in Cloud Identity Engine.
  Authentication Profile—Select or create the authentication profile based on the Cloud Identity Engine profile you created in step 1.c.
  
  The agent supports a combination of SAML user logon and client certificate pre-logon as follows:
  During pre-logon, the agent applies the first certificate-based User Authentication configuration.
  During user logon, the agent applies the top User Authentication profile.
  
  The following image shows a sample authentication configuration for SAML user logon and client certificate pre-logon:
Configure the agent settings for the pre-logon user, which is a default identity that Prisma Access Agent uses for all traffic during pre-logon device tunnel sessions. When the agent establishes connectivity before user authentication, it associates all network traffic with the pre-logon user identity for policy evaluation and enforcement.

If you don't want to have a specific pre-logon user that has a different configuration than a standard agent, skip this step and go to Step 4.
1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
2. Add Agent Settings to create the pre-logon user.
3. In the Match Criteria, select User EntitiesMatch anyMatch pre-logon. With this setting, devices running the pre-logon tunnel will get the pre-logon agent configurations.
4. In the Connect drop-down, select Always On or On-Demand.
  
  This setting determines if the SAML authentication pop-up (if applicable) appears automatically after operating system logon. The SAML authentication pop-up appears automatically for always-on connections.
5. Configure the pre-logon device tunnel.
  Select Enable Pre-Logon Device Tunnel.
  Configure the tunnel behavior (Post-Logon Behavior) based on your operational requirements:
  
  To maintain the pre-logon tunnel until users successfully authenticate, select Persistent Pre-Logon Tunnel. This is the default post-logon behavior.
  To maintain the pre-logon tunnel for a specified duration after OS login, select Terminate Pre-Logon Upon OS Login and set the Pre-Logon Tunnel Rename Timeout value in minutes. The range is 0-180 minutes. The default is 5 minutes.
  This setting determines how long the pre-logon tunnel will remain active before transitioning to a user-specific tunnel (when the pre-logon tunnel gets renamed to the user-specific tunnel).
  Setting the pre-logon tunnel rename timeout to 0 will disconnect the pre-logon tunnel immediately upon OS login.
6. Configure other agent settings as needed for the pre-logon user, such as gateway and forwarding profile settings.
7. Save your settings.
Specify which users you want to have the pre-logon capability by setting up a standard agent setting.
1. In Strata Cloud Manager, select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess AgentSetupPrisma Access Agent.
2. Add Agent Settings or select an existing agent setting to edit.
3. In the Match Criteria section, specify the OS and User Entities that you want to receive the pre-logon functionality.
4. In the Connect drop-down, select Always On or On-Demand.
  
  This setting determines the connect method for the user logon mode
5. Enable pre-logon.
  Select Enable Pre-Logon Device Tunnel.
  
  Configure the tunnel transition behavior (Post-Logon Behavior) based on your operational requirements.
  
  To reduce confusion, use the same pre-logon timeout configuration across both application settings (pre-logon user and standard user).
  
  To maintain the pre-logon tunnel until users successfully authenticate, select Persistent Pre-Logon Tunnel. This is the default post-logon behavior.
  To maintain the pre-logon tunnel for a specified duration after OS login, select Terminate Pre-Logon Upon OS Login and set the Pre-Logon Tunnel Rename Timeout value in minutes. The range is 0-180 minutes. The default is 5 minutes.
  This setting determines how long the pre-logon tunnel will remain active before transitioning to a user-specific tunnel (when the pre-logon tunnel gets renamed to the user-specific tunnel).
  Setting the pre-logon tunnel rename timeout to 0 will disconnect the pre-logon tunnel immediately upon OS login.
6. Configure other agent settings as needed for the pre-logon user, such as gateway and forwarding profile settings.
7. Save your settings.
To allow endpoints to access resources, create security policy rules that match the pre-logon user. These policy rules should allow access to only the basic services for starting up the system; for example, DHCP, DNS, specific Active Directory services, antivirus, or other update services.
1. Select ConfigurationNGFW and Prisma AccessConfiguration ScopeAccess Agent.
2. Select Security ServicesSecurity Policies.
3. Select Add RuleSecurity Rule to create a security policy rule or modify an existing rule.
4. Build the rule by configuring the appropriate rule components. Be sure to select UsersPre Logon.
Push the Prisma Access Agent Configuration.
Update the Prisma Access Agent configuration file (config.json) for predeployment by adding the server_url and pre_logon_supported statements. For example:
```
{
    "server_url": "xxx.epm.gpcloudservice.com",
    "tenant_id": "xxxxxxxxxx",
    "pre_logon_supported": true
}
```
This will cause the agent to enroll to the Endpoint Manager during pre-logon. Predeployment is only necessary for the first-time user.
Verify the pre-logon device tunnel operation using the Prisma Access Agent app.
1. Restart an endpoint to trigger the pre-logon connection sequence.
2. Before logging in, verify that the agent establishes connectivity and displays the pre-logon connection status in the agent interface.
3. Log into the operating system with a user account.
4. Verify that the agent transitions to user authentication according to your configured transition behavior.
5. Sign out from the operating system and verify that the agent automatically re-establishes the pre-logon tunnel.
  
  This behavior depends on the configured pre-logon tunnel rename timeout value. If user signs out of the agent and not the operating system, the pre-logon tunnel reverts back to the timeout value.
Verify the pre-logon tunnel status using the pacli command on the endpoint.
1. Run the pacli epm status command and check the Authentication Status and User type fields in the output.
  
  A user type of Prelogon indicates that the user has not signed on to the operating system and the pre-logon tunnel is active. A user type of Logged on indicates that the user has successfully authenticated to the operating system and the pre-logon tunnel has transitioned to the user-specific tunnel.
2. Run the pacli status command and check the Mode field to determine the tunnel mode that’s active.
  
  After transitioning to the user-specific tunnel, the mode will change to the previously configured connection mode for the user (Always On or On Demand) and the same agent session will resume.
Monitor the Endpoint Management page to view the number of devices currently connected in pre-logon mode.
1. Select ConfigurationEndpoint Management.
2. The Agent Status chart will show the number of agents connected to the gateway via the pre-logon tunnel. The status for agents in the pre-logon mode is connected-prelogon.
3. The Agent Status column in the Devices table will show that a device is connected via the pre-logon tunnel with status connected-prelogon. In pre-logon mode, the User is always pre-logon.
  
  To show the users who are connected in pre-logon mode, you can filter on the User column to show only users the username of pre-logon.
  
  After the pre-logon tunnel s to the user-specific tunnel, the Agent Status will change to connected, and the User column will display the username associated with the device.
  
  There might be a brief interval (a few seconds) when the tunnel becomes disconnected during the tunnel . However, typically the agent will reconnect before sending the disconnection status to the Endpoint Management page.