Enter a login username for the administrator (up to 15 characters). The name is case-sensitive, must be unique, and can contain only letters, numbers, hyphens, and underscores.

Select an authentication profile or sequence to authenticate this administrator. For details, see Device > Authentication Profile or Device > Authentication Sequence.

Select to use client certificate authentication for web interface access. If you select this option, a username (

Name

) and

Password

are not required.

Enter and confirm a case-sensitive password for the administrator (up to 15 characters). To ensure security, Palo Alto Networks recommends that administrators change their passwords periodically using a combination of lowercase letters, uppercase letters, and numbers. Be sure to use the best practices for password strength to ensure a strict password.

Device Group and Template administrators cannot access

Panorama

Administrators

. To change their local password, these administrators click their username (beside

Logout

at the bottom of the web interface). This also applies to administrators with a custom Panorama role in which access to

Panorama

Administrators

is disabled.

You can use password authentication in conjunction with an

Authentication Profile

(or sequence) or with local database authentication.

You can set password expiration parameters by selecting a

Password Profile

(see Device > Password Profiles) and setting Minimum Password Complexity parameters (see Device > Setup > Management), but only for administrative accounts that Panorama authenticates locally.

Select to use SSH public key authentication: click

Import Key

,

Browse

to select the public key file, and click

OK

. The Administrator dialog displays the uploaded key in the read-only text area.

Supported key file formats are IETF SECSH and OpenSSH. Supported key algorithms are DSA (1024 bits) and RSA (768 to 4096 bits).

The type selection determines the administrative role options:

Select a predefined role:

Select a custom Panorama role (see Panorama > Managed Devices > Summary).

For each access domain (up to 25) you want to assign to the administrator,

Add

an

Access Domain

from the drop-down (see Panorama > Access Domains) and then click the adjacent Admin Role cell and select a custom Device Group and Template administrator role from the drop-down (see Panorama > Managed Devices > Summary). When administrators with access to more than one domain log in to Panorama, an

Access Domain

drop-down appears in the footer of the web interface. Administrators can select any assigned

Access Domain

to filter the monitoring and configuration data that Panorama displays. The

Access Domain

selection also filters the firewalls that the

Context

drop-down displays.