Configuring the Palo Alto Firewall for use with Juniper Steel-Belted RADIUS.

Transcription

1 Configuring the Palo Alto Firewall for use with Juniper Steel-Belted RADIUS. Prepared for Palo Alto Networks by James Costello Armada Data Solutions Palo Alto Networks Partner 970 Peachtree Industrial Blvd Sunwanee GA, 30024

2 Configuring Steel-Belted RADIUS authentication for a Palo Alto Firewall Juniper s Steel-Belted RADIUS is a corporate solution for RADIUS authentication. This document is based upon Steel-Belted RADIUS Enterprise Edition and describes how to configure a local user account to authenticate. LDAP authentication differs slightly. Palo Alto Firewall RADIUS configuration 1. Login to the Palo Alto Firewall 2. Go to Device > Server Profiles > RADIUS 2011 Palo Alto Networks Page 2

3 1. Click Add and enter the following information a. Name b. Domain c. Timeout adjustment d. Retries e. Check Administrator Use Only if this will be for Palo Alto device authentication f. Click Add and enter the following information 2011 Palo Alto Networks Page 3

4 i. Name ii. IP address iii. Port iv. Shared Secret v. Repeat for each additional RADIUS device (up to 3 total) b. Click OK 3. Go to Device > Authentication Profiles 2011 Palo Alto Networks Page 4

5 1. Click Add and enter the following information a. Enter a name to identify the profile. b. Select the virtual system from the drop-down list or select shared c. Enter the number of failed login attempts that are allowed before the account is locked out (1-10, default 0). 0 means that there is no limit. d. Enter the number of minutes that a user is locked out if the number of failed attempts is reached (0-60 minutes, default 0). 0 means that the lockout is in effect until it is manually unlocked. e. Specify the users and groups that are explicitly allowed to authenticate. i. Click Edit Allow List and do any of the following: 2011 Palo Alto Networks Page 5

6 1. Select the check box next to the appropriate user or user group in the Available column, and click Add to add your selections to the Selected column. 2. Use the All check box to apply to all users. 3. Enter the first few characters of a name in the Search field to list all the users and user groups that start with those characters. Selecting an item in the list sets the check box in the Available column. Repeat this process as often as needed, and then click Add. 4. To remove users or user groups, select the appropriate check boxes in the Selected column and click Remove, or select any to clear all users Palo Alto Networks Page 6

7 b. Choose RADIUS as the type of authentication a. Select the RADIUS authentication server from the drop-down list. b. Click OK 4. Optional Step Assigning RADIUS as authentication method for Palo Alto a. Device > Setup >Edit setup (main window in right pane) b. Click Edit c. Use the drop down on Authentication Profile to select the profile that was created above. d. Click Ok 5. Click Commit to commit the configuration 2011 Palo Alto Networks Page 7

8 Steel-Belted RADIUS Configuration Dictionary 1. Radius\Service on Windows computers or /opt/jnprsbr/radius on Solaris/Linux computers 2. Restart the RADIUS service to recognize the new dictionary file RADIUS Client 1. Launch the SBR Administrator 2. Click on RADIUS Clients item in the left window 3. Click Add 2011 Palo Alto Networks Page 8

9 4. Enter the following information a. Name (unique for each device is recommended) b. IP Address c. Shared Secret d. Select Palo Alto for the Make or model e. All other fields are optional f. Click OK Setup a Profile 1. Click on Profiles in the left window 2011 Palo Alto Networks Page 9

10 2. Click Add 3. Enter the following information a. Name - must be unique b. Description helpful but not required c. Click on the Attributes Return List tab d. Click Add 2011 Palo Alto Networks Page 10

11 i. Scroll down to Paloalto-Admin-Role Attribute and add the appropriate role name for this profile 1. superuser 2. superreader 3. deviceadmin 4. devicereader 5. Custom Admin Profiles can be added as well see the Palo Alto Administration guides for how to set those up. ii. Click Add e. Repeat additions for the other attributes as needed i. PaloAlto-Admin-Access-Domain 1. PaloAlto-Admin-Access-Domain is the name of the access domain object defined on the Palo Alto Networks device ii. PaloAlto-Panorama-Admin-Role 1. PaloAlto-Panorama-Admin-Role is the name of the role for the user it can be the name of a custom Admin role profile configured on the Panorama server or one of the following predefined roles a. superuser : Superuser b. superreader : Superuser (read-only) c. panorama-admin : Panorama administrator iii. PaloAlto-Panorama-Admin-Access-Domain 1. PaloAlto-Panorama-Admin-Access-Domain is the name of the access domain object defined on the Panorama server iv. PaloAlto-User-Group 1. PaloAlto-User-Group is the name of the group of users that can be used in allow lists in authentication profiles for access control purposes v. When done click Close f. Click OK 2011 Palo Alto Networks Page 11

12 Setup Native User authentication 1. Click on Users and then Native in the left window 2. Click Add Conclusion a. Enter the following information: i. Name (must be unique) ii. Password iii. Description iv. Check Use Profile and use the drop down to select the Profile that was created in previous steps. b. Click OK That is basic configuration using Steel-Belted RADIUS. It is possible to use Active Directory, TACACS +, Secure ID and LDAP to do back end authentication but those are outside the scope of this initial configuration document Palo Alto Networks Page 12

13 Appendix 1: The paloalto.dct file # # # Palo Alto Networks - Steel Belted RADIUS Dictionary File # ATTRIBUTE Paloalto-Admin-Role 26 [vid=25461 type1=1 len1=+2 data=string] r # PaloAlto-Admin-Role is the name of the role for the user # it can be the name of a custom Admin role profile configured on the # Palo Alto Networks device or one of the following predefined roles # superuser : Superuser # superreader : Superuser (read-only) # deviceadmin : Device administrator # devicereader : Device administrator (read-only) # vsysadmin : Virtual system administrator # vsysreader : Virtual system administrator (read-only) ATTRIBUTE PaloAlto-Admin-Access-Domain 26 [vid=25461 type1=2 len1=+2 data=string] r # PaloAlto-Admin-Access-Domain is the name of the access domain object defined # on the Palo Alto Networks device ATTRIBUTE PaloAlto-Panorama-Admin-Role 26 [vid=25461 type1=3 len1=+2 data=string] r # PaloAlto-Panorama-Admin-Role is the name of the role for the user # it can be the name of a custom Admin role profile configured on the # Panorama server or one of the following predefined roles # superuser : Superuser # superreader : Superuser (read-only) # panorama-admin : Panorama administrator ATTRIBUTE PaloAlto-Panorama-Admin-Access-Domain 26 [vid=25461 type1=4 len1=+2 data=string] r # PaloAlto-Panorama-Admin-Access-Domain is the name of the access domain # object defined on the Panorama server ATTRIBUTE PaloAlto-User-Group 26 [vid=25461 type1=5 len1=+2 data=string] r # PaloAlto-User-Group is the name of the group of users that can be used in # allow lists in authentication profiles for access control purposes # # #Note this text may contain artifacts from Microsoft Word that will need to be removed Palo Alto Networks Page 13