Prisma Access
Create a Kerberos Keytab
Table of Contents
Expand All
|
Collapse All
Prisma Access Docs
-
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
-
-
-
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Create a Kerberos Keytab
Create a Keberos Keytab for deploying Kerberos for Explicit Proxy in
Prisma Access
.Where Can I Use
This? | What Do I Need? |
---|---|
|
|
After you review the requirements and recommendations for
deploying Kerberos for Explicit Proxy, you're ready to create a Kerberos
keytab.
For optimal performance, the keytab file should be less than
60 KB in size.
- Get the FQDN, proxy FQDNs, and DNS CNAMEs that are required to set up your Kerberos authentication.Kerberos authentication uses the information retrieved from thePrisma Accessto create and configure the Kerberos keytabs. The API script retrieves the following information:
- ep_geo_lb_fqdn—The Explicit Proxy DNS FQDN used in the Explicit Proxy network load balancer configuration. This FQDN is identical to the Explicit ProxyExplicit Proxy URLin thePrisma AccessUI under.ManageService SetupExplicit ProxyExplicit Proxy URLIf you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupExplicit ProxyInfrastructure SettingsExplicit Proxy URL
- ep_geo_lb_cname—The DNS CNAME for the Explicit Proxy tenant.
- ep_regional_fqdn—The FQDNs used for the onboarded Explicit Proxy locations.Explicit Proxy gives each location a public IP address for the network load balancer; the ep_regional_fqdn is the FQDN associated with that IP address. If multiple locations share the same public IP address, those locations use the same regional FQDN.
- Generate an API key to use as part of a curl command.
- OnPrisma Access (Managed by Strata Cloud Manager), selectManageService SetupSharedPrisma AccessSetupInfrastructure SettingsGenerate New API KeyIf you're using Strata Cloud Manager, go to.WorkflowsPrisma AccessSetupPrisma AccessInfrastructure SettingsGenerate New API Key
- OnPanorama Managed Prisma Access, selectPanoramaCloud ServicesConfigurationService SetupGenerate API Key
- Create a .txt file and enter the following command options in the file:{ "serviceType": "swg_proxy", "location": "deployed", "addrType": "network_load_balancer" }
- Enter the following command to retrieve the required FQDNs to use Kerberos authentication:curl -X POST --data @option.txt -H header-api-key:Current-API-Key "https://api.prod.datapath.prismaaccess.com/getPrismaAccessIP/v2"Whereoption.txtis the .txt file you created in a previous step andCurrent-API-Keyis the Prisma Access API key.
- Make a note of the FQDNs.There is at least oneep_geo_lb_fqdn, oneep_geo_lb_cname, and oneep_regional_fqdnper onboarded location.
- Create a new user for thePrisma AccessExplicit Proxy service in your organization’s Active Directory (AD) by entering the following command:New-ADUser -Name "USER_NAME" -GivenName "USER_GIVEN_NAME" -SamAccountName "USER_SAMACCOUNTNAME" -UserPrincipalName "USER_NAME@DNS_DOMAIN_NAME" -Path "X_500_PATH" –AccountPassword (ConvertTo-SecureString “PASSWORD” -AsPlainText -force) -Enabled $true -KerberosEncryptionType RC4,AES128,AES256Where:
- USER_NAMEis the name of the user object.
- USER_GIVEN_NAMEis the user’s given name.
- USER_SAMACCOUNTNAMEis the user’s Security Account Manager (SAM) name.
- USER_NAME@DNS_DOMAIN_NAMEis the user’s user principal name (UPN).
- X_500_PATHis the X.500 path of the OU or container where the new object is created (for example,DC=EXAMPLE,DC=COM.)
- PASSWORDis the password to use for the account.
The following CLI example has a user name ofexample, a SAM name ofexample, a given name ofPrismaAccess EP Service User, a UPN ofexample@exmp.com, a path ofDC=EXMP,DC=COM, and a password of Ex@mple123:New-ADUser -Name "example" -GivenName "PrismaAccess EP Service User" -SamAccountName "example" -UserPrincipalName "example@exmp.com" -Path "DC=EXMP,DC=COM" –AccountPassword (ConvertTo-SecureString “Ex@mple123” -AsPlainText -force) -Enabled $true -KerberosEncryptionType RC4,AES128,AES256The previous command specifies an encryption type of RC4, which uses a weak NTLM hash. Follow your organization’s security policies and guidelines to include or exclude RC4 in this command. - Enter the following command to prevent the password from expiring and to prevent it from being changed:Get-ADUserUSER_NAME|Set-ADUser -PasswordNeverExpires:$True -CannotChangePassword:$trueFollow your organization’s security policies and guidelines for password expiration and rotation policies.
- Enter the following command to display the newly-created user account:Get-ADUserUSER_NAME-property msDS-KeyVersionNumber
- Associate the SPNs and export keytab files to use with Kerberos authentication in your Windows AD.A keytab file allows Explicit Proxy to validate the Kerberos authentication tokens provided during the traffic flows from users, servers, IoT devices, or other headless machines. During the keytab file creation, Explicit Proxy requires that the values you retrieved using the API in an earlier step be associated as ServicePrincipalNames (SPNs) with the user account you created in the step following that one.Use theep_geo_lb_fqdn,ep_geo_lb_cname, andep_regional_fqdnvalues. These values allow Explicit Proxy to authenticate traffic flows to either of those proxy domains.
- Generate and export a keytab using theep_geo_lb_fqdnvalue as the service principal name (SPN) by entering the following commands:ktpass -princ HTTP/ep_geo_lb_fqdn@REALM-mapuserDOMAIN\USER_NAME-ptype KRB5_NT_PRINCIPAL -crypto all -passPASSWORD-outKEYTAB_NAME_1.keytabWhere:
- ep_geo_lb_fqdnis theep_geo_lb_fqdnvalue returned from the Explicit Proxy API script.
- REALMis the realm (for example,EXMP.COM).In most cases, you enter the realm using uppercase letters.
- DOMAIN\USER_NAMEis the domain-level logon name (for example,EXMP\example).
- PASSWORDis the password to use for the keytab. This password does not have to match the user password, but must match the value you create for theep_geo_lb_cnameandep_regional_fqdnSPNs in the next steps.
- KEYTAB_NAME_1is the name of the keytab. The keytab name must be unique to this SPN.
Be sure to follow the best practices for creating SPNs and passwords.The following CLI example has anep_geo_lb_fqdnofexample.proxy.prismaaccess.com, aREALMofEXMP.COM, aDOMAIN\USER_NAMEofEXMP\example, aPASSWORDofEx@mple123, and an exported keytab name ofexmp1.keytab:ktpass -princ HTTP/example.proxy.prismaaccess.com@EXMP.COM -mapuser EXMP\example -ptype KRB5_NT_PRINCIPAL -crypto all -pass Ex@mple123 -out exmp1.keytab - Generate and export a keytab using theep_geo_lb_cnamevalue as the SPN by entering the following commands:ktpass -princ HTTP/ep_geo_lb_cname@REALM-mapuserDOMAIN\USER_NAME-ptype KRB5_NT_PRINCIPAL -crypto all -passPASSWORD-outKEYTAB_NAME_2.keytabWhere:
- ep_geo_lb_cnameis theep_geo_lb_cnamevalue returned from the Explicit Proxy API script.
- REALMis the realm for example,EXMP.COM
- DOMAIN\USER_NAMEis the domain-level logon name (for example,EXMP\example).
- PASSWORDis the password to use for the keytab. This password must match theep_geo_lb_fqdnandep_regional_fqdnSPN passwords.
- KEYTAB_NAME_2is the name of the keytab you want to export. This name should be different than the other SPN keytab names you create.
The following CLI example has anep_geo_lb_cnameofprisma-abcde12345.proxy.prismaaccess.com, aREALMofEXMP.COM, aDOMAIN\USER_NAMEofEXMP\example, aPASSWORDofEx@mple123, and an exported keytab name ofexmp2.keytab:ktpass -princ HTTP/prisma-abcde12345.proxy.prismaaccess.com@EXMP.COM -mapuser EXMP\example -ptype KRB5_NT_PRINCIPAL -crypto all -pass Ex@mple123 -out exmp2.keytab - Generate and export a keytab using theep_regional_fqdnvalue as the SPN by entering the following commands:ktpass -princ HTTP/ep_regional_fqdn@REALM-mapuserDOMAIN\USER_NAME-ptype KRB5_NT_PRINCIPAL -crypto all -passPASSWORD-outKEYTAB_NAME_3.keytabWhere:
- ep_regional_fqdnis theep_regional_fqdnvalue returned from the Explicit Proxy API script.
- REALMis the realm (for example,EXMP.COM).
- DOMAIN\USER_NAMEis the domain-level logon name (for example,EXMP\example).
- PASSWORDis the password to use for the keytab. This password must match theep_geo_lb_fqdnandep_geo_lb_cnameSPN passwords.
- KEYTAB_NAME_3is the name of the keytab you want to export. This name should be different than the other SPN keytab names you create.
The following CLI example has anep_regional_fqdnofus-west-2.prisma-abcde12345.proxy.prismaaccess.com, aREALMofEXMP.COM, aDOMAIN\USER_NAMEofEXMP\example, aPASSWORDofEx@mple123, and an exported keytab name ofexmp3.keytab:ktpass -princ HTTP/us-west-2.prisma-abcde12345.proxy.prismaaccess.com@EXMP.COM -mapuser EXMP\example -ptype KRB5_NT_PRINCIPAL -crypto all -pass Ex@mple123 -out exmp3.keytab(Optional) If you have additional locations that use differentep_regional_fqdnvalues, and you want to create keytabs for those locations, generate and export one or more additional keytabs by repeating Step 6.c, using theep_regional_fqdnvalue for those locations.Create a unique keytab name for each uniqueep_regional_fqdn. For example, if theep_regional_fqdnfor another location isus-east-2.prisma-abcde12345.proxy.prismaaccess.com, enter the following sample CLI with a unique exported keytab file name:ktpass -princ HTTP/us-east-2.prisma-abcde12345.proxy.prismaaccess.com@EXMP.COM -mapuser EXMP\example -ptype KRB5_NT_PRINCIPAL -crypto all -pass Ex@mple123 -out exmp4.keytab - Delete unsupported ciphers in the created keytabs by entering the followingktutilcommands in Ubuntu.The following system output provides examples for cleaning up various ciphers:slot KVNO Principal ---- ---- --------------------------------------------------------------------- 1 3 HTTP/us-west-2.prisma-abcde12345.proxy.prismaaccess.com@PANW.COM (des-cbc-crc) 2 3 HTTP/us-west-2.prisma-abcde12345.proxy.prismaaccess.com@PANW.COM (des-cbc-md5) 3 3 HTTP/us-west-2.prisma-abcde12345.proxy.prismaaccess.com@PANW.COM (arcfour-hmac) 4 3 HTTP/us-west-2.prisma-abcde12345.proxy.prismaaccess.com@PANW.COM (aes256-cts-hmac-sha1-96) 5 3 HTTP/us-west-2.prisma-abcde12345.proxy.prismaaccess.com@PANW.COM (aes128-cts-hmac-sha1-96)# display all keytabs, get the key entry numbers to remove DES-CBC-MD5 and DES-CBC-CRC. # Also, enable or disable RC4-HMAC based on your organization’s policy. for i in `ls keytab_name*.keytab`; do echo $i; klist -Kte -k $i; done # cleanup unsupported ciphers # entry #1 is typically des-cbc-crc # entry #2 is typically des-cbc-md5 # entry #3 is typically arcfour-hmac ktutil rktKEYTAB_NAME_1.keytab delent 2 delent 1 wkt new1.keytab quit ktutil rktKEYTAB_NAME_2.keytab delent 2 delent 1 wkt new2.keytab quit ktutil rktKEYTAB_NAME_3.keytab delent 2 delent 1 wkt new3.keytab quitWhereKEYTAB_NAME_1.keytab,KEYTAB_NAME_2.keytab, andKEYTAB_NAME_3.keytab are the keytabs you created in the previous step.
- (Optional) If you created more keytabs for other regions, remove unsupported ciphers on those keytabs by entering the previousktutilcommand, substitutingKEYTAB_NAME_1.keytab with the keytab name you used for the region or regions and specifying a different output file (for example,new4.keytab,new5.keytab, and so on).
- Merge the keytabs you created by entering the followingktutilcommand, where new1.keytab, new2.keytab, and new3.keytab are the keytabs you created in the previous step, Be sure to include all the region-specific keytabs in this command:ktutil rkt new1.keytab rkt new2.keytab rkt new3.keytab # if you created any additional region-specific keytab files, add them here. wkt papxv1.keytab quitWhen complete, you use the keytab you created (papxv1.keytabin this example) as the keytab to use with Explicit Proxy.