Configure Local or External Authentication for Firewall Administrators
You can use Local Authentication and External Authentication Services to authenticate administrators who access the firewall. These authentication methods prompt administrators to respond to one or more authentication challenges, such as a login page for entering a username and password.
If you use an external service to manage both authentication and authorization (role and access domain assignments), see:
To authenticate administrators without a challenge-response mechanism, you can Configure Certificate-Based Administrator Authentication to the Web Interface and Configure SSH Key-Based Administrator Authentication to the CLI.
- (External authentication only) Enable
the firewall to connect to an external server for authenticating
administrators.Configure a server profile:
- If the firewall integrates with a Multi-Factor Authentication (MFA) service through RADIUS, you must add a RADIUS server profile. In this case, the MFA service provides all the authentication factors (challenges). If the firewall integrates with an MFA service through a vendor API, you can still use a RADIUS server profile for the first factor but MFA server profiles are required for additional factors.
- Add an MFA server profile.
- Add a TACACS+ server profile.
- Add a SAML IdP server profile. You cannot combine Kerberos single sign-on (SSO) with SAML SSO; you can use only one type of SSO service.
- Add a Kerberos server profile.
- Add an LDAP server profile.
- (Local database authentication only) Configure a user database that is local to the firewall.
authentication only) Define password complexity and expiration
settings.These settings help protect the firewall against unauthorized access by making it harder for attackers to guess passwords.
- Define global password complexity and expiration
settings for all local administrators. The settings don’t apply
to local database accounts for which you specified a password hash
instead of a password (see Local
- Select DeviceSetupManagement and edit the Minimum Password Complexity settings.
- Select Enabled.
- Define the password settings and click OK.
a Password Profile.You assign the profile to administrator accounts for which you want to override the global password expiration settings. The profiles are available only to accounts that are not associated with a local database (see Local Authentication).
- Select DevicePassword Profiles and Add a profile.
- Enter a Name to identify the profile.
- Define the password expiration settings and click OK.
- Define global password complexity and expiration settings for all local administrators. The settings don’t apply to local database accounts for which you specified a password hash instead of a password (see Local Authentication).
- (Kerberos SSO only) Create
a Kerberos keytab.A keytab is a file that contains Kerberos account information for the firewall. To support Kerberos SSO, your network must have a Kerberos infrastructure.
- Configure an authentication profile.If your administrative accounts are stored across multiple types of servers, you can create an authentication profile for each type and add all the profiles to an authentication sequence.Configure an Authentication Profile and Sequence. In the authentication profile, specify the Type of authentication service and related settings:
- External service—Select the Type of external service and select the Server Profile you created for it.
- Local database authentication—Set the Type to Local Database.
- Local authentication without a database—Set the Type to None.
- Kerberos SSO—Specify the Kerberos Realm and Import the Kerberos Keytab.
- Assign the authentication profile or sequence to an administrator
a Firewall Administrator Account.
- Assign the Authentication Profile or sequence that you configured.
- (Local database authentication only) Specify the Name of the user account you added to the local database.
- Commit your changes.
- (Optional) Test Authentication Server Connectivity to verify that the firewall can use the authentication profile to authenticate administrators.
- Configure a Firewall Administrator Account.
Configure Local or External Authentication for Panorama Adm...
Configure Local or External Authentication for Panorama Administrators You can use an external authentication service or the service that is local to Panorama to authenticate ...
Configure an Authentication Profile and Sequence
Configure an Authentication Profile and Sequence An authentication profile defines the authentication service that validates the login credentials of administrators who access the firewall web ...
Local Authentication Although the firewall and Panorama provide local authentication for administrators and end users, External Authentication Services are preferable in most cases because they ...
Configure the Portal to Authenticate Satellites
Configure the Portal to Authenticate Satellites In order to register with the LSVPN, each satellite must establish an SSL/TLS connection with the portal. After establishing ...
Authentication Profiles and Sequences
Authentication Profiles and Sequences An authentication profile defines the authentication service that validates the login credentials of administrators when they access Panorama. The service can ...
Administrative Authentication You can configure the following types of authentication and authorization ( Administrative Roles and Access Domains ) for Panorama administrators: Authentication Method Authorization ...
Configure an Authentication Profile
Authentication Profile Device > Authentication Profile Select Device Authentication Profile or Panorama Authentication Profile to manage authentication profiles. To create a new profile, Add one ...
Configure Multi-Factor Authentication
Configure Multi-Factor Authentication To use Multi-Factor Authentication (MFA) for protecting sensitive services and applications, you must configure Captive Portal to display a web form for ...
Authentication Types External Authentication Services Multi-Factor Authentication SAML Kerberos TACACS+ RADIUS LDAP Local Authentication ...