54
26 • Panorama 7.0 Administrator’s Guide
© Palo Alto Networks, Inc.
Role‐Based Access Control
Panorama Overview
Admin Role Profiles—To provide more granular access control over the functional areas of the web
interface, CLI, and XML API, you can create custom roles. When new features are added to the product,
you must update the roles with corresponding access privileges: Panorama does not automatically add
new features to custom role definitions. You select one of the following profile types when you Configure
an Admin Role Profile.
Authentication Profiles and Sequences
An authentication profile specifies the authentication service that validates the credentials of an
administrator during login and defines how Panorama accesses the service. If you create a local administrator
account on Panorama, you can authenticate the administrator to the local database, use an external service
(RADIUS, TACACS+, LDAP, or Kerberos server), or use Kerberos single sign‐on (SSO). If you use an external
service, you must configure a server profile before you Configure an Admin Role Profile. If you want to use
an external service for both account administration (instead of creating local accounts) and for
authentication, you must Configure RADIUS Vendor‐Specific Attributes for Administrator Authentication.
Panorama administrator
Full access to Panorama except for the following actions:
• Create, modify, or delete Panorama or device administrators and roles.
• Export, validate, revert, save, load, or import a configuration in the Device > Setup >
Operations page.
• Configure Scheduled Config Export functionality in the Panorama tab.
Admin Role Profile
Description
Panorama
For these roles, you can assign read‐write access, read‐only access, or no access to all the
Panorama features that are available to the superuser dynamic role except the
management of Panorama administrators and Panorama roles. For the latter two features,
you can assign read‐only access or no access, but you cannot assign read‐write access.
An example use of a Panorama role would be for security administrators who require
access to security policy definitions, logs, and reports on Panorama.
Device Group and
Template
For these roles, you can assign read‐write access, read‐only access, or no access to specific
functional areas within device groups, templates, and firewall contexts. By combining
these roles with Access Domains, you can enforce the separation of information among
the functional or regional areas of your organization. Device Group and Template roles
have the following limitations:
• No access to the CLI or XML API
• No access to configuration or system logs
• No access to VM information sources
• In the Panorama tab, access is limited to:
• Device deployment features (read‐write, read‐only, or no access)
• The device groups specified in the administrator account (read‐write, read‐only, or
no access)
• The templates and managed devices specified in the administrator account
(read‐only or no access)
An example use of this role would be for administrators in your operations staff who
require access to the device and network configuration areas of the web interface for
specific device groups and/or templates.
Dynamic Role
Privileges
48
© Palo Alto Networks, Inc.
Panorama 7.0 Administrator’s Guide • 27
Panorama Overview
Role‐Based Access Control
Some environments have multiple databases for different users and user groups. To authenticate to multiple
authentication sources (for example, local database and LDAP), configure an authentication sequence. An
authentication sequence is a ranked order of authentication profiles that an administrator is matched against
when logging in. Panorama checks against the local database first, and then checks each profile in sequence
until the administrator is successfully authenticated. The administrator is denied access to Panorama only if
authentication fails for all the profiles defined in the authentication sequence.
Access Domains
Access domains control administrative access to specific device groups (to manage policies and objects) and
templates (to manage network and device settings), and also control the ability to switch context to the web
interface of managed firewalls. Access domains apply only to administrators with Device Group and
Template roles. By combining access domains with Administrative Roles, you can enforce the separation of
information among the functional or regional areas of your organization.
You can manage access domains locally or by using RADIUS Vendor‐Specific Attributes (VSAs). To use
RADIUS VSAs, your network requires an existing RADIUS server and you must configure a RADIUS server
profile to define how Panorama accesses the server. On the RADIUS server, you define a VSA attribute
number and value for each administrator. The value defined must match the access domain configured on
Panorama. When an administrator tries to log in to Panorama, Panorama queries the RADIUS server for the
administrator access domain and attribute number. Based on the response from the RADIUS server, the
administrator is authorized for access and is restricted to the firewalls, virtual systems, device groups, and
templates that are assigned to the access domain.
For the relevant procedures, see:
Configure an Access Domain.
Configure RADIUS Vendor‐Specific Attributes for Administrator Authentication.
Administrative Authentication
The following methods are available to authenticate Panorama administrators:
Local administrator account with local authentication—Both the administrator account credentials and
the authentication mechanisms are local to Panorama. To further secure the local administrator account,
create a password profile that defines a validity period for passwords and set Panorama‐wide password
complexity settings. For details on how to configure this type of administrative access, see Configure an
Administrator with Kerberos SSO, External, or Local Authentication.
Local administrator account with certificate‐ or key‐based authentication—With this option, the
administrator accounts are local to Panorama, but authentication is based on Secure Shell (SSH) keys (for
CLI access) or client certificates/common access cards (for the web interface). For details on how to
configure this type of administrative access, see Configure an Administrator with Certificate‐Based
Authentication for the Web Interface and Configure an Administrator with SSH Key‐Based
Authentication for the CLI.
Local administrator account with external authentication—The administrator accounts are managed on
Panorama, but existing external authentication services (LDAP, Kerberos, TACACS+, or RADIUS) handle
the authentication functions. If your network supports Kerberos single sign‐on (SSO), you can configure
14
28 • Panorama 7.0 Administrator’s Guide
© Palo Alto Networks, Inc.
Role‐Based Access Control
Panorama Overview
external authentication as an alternative in case SSO fails. For details on how to configure this type of
administrative access, see Configure an Administrator with Kerberos SSO, External, or Local
Authentication.
External administrator account and authentication—An external RADIUS server handles account
administration and authentication. To use this option, you must define Vendor‐Specific Attributes (VSAs)
on your RADIUS server that map to the administrator roles and access domains. For a high‐level overview
of the process, see Configure RADIUS Vendor‐Specific Attributes for Administrator Authentication. For
details on how to configure this type of administrative access, refer to Radius Vendor‐Specific Attributes
(VSAs).
26
© Palo Alto Networks, Inc.
Panorama 7.0 Administrator’s Guide • 29
Panorama Overview
Panorama Recommended Deployments
Panorama Recommended Deployments
A Panorama deployment comprises the Panorama management server (which has a browser‐based
interface), optional Log Collectors, and the Palo Alto Networks firewalls that Panorama manages. The
recommended deployments are:
Panorama for Centralized Management and Reporting
Panorama in a Distributed Log Collection Deployment
Panorama for Centralized Management and Reporting
The following diagram illustrates how you can deploy the Panorama virtual appliance or M‐Series appliance
in a redundant configuration for the following benefits:
Centralized management—Centralized policy and device management that allows for rapid deployment
and management of up to one thousand firewalls.
Visibility—Centralized logging and reporting to analyze and report on user‐generated traffic and potential
threats.
Role‐based access control—Appropriate levels of administrative control at the firewall level or global
level for administration and management.
For the procedures to configure the most typical log collection deployments, see Log Collection
Deployments.
25
30 • Panorama 7.0 Administrator’s Guide
© Palo Alto Networks, Inc.
Panorama Recommended Deployments
Panorama Overview
Panorama in a Distributed Log Collection Deployment
You can deploy the hardware‐based Panorama—the M‐Series appliance—either as a Panorama management
server that performs management and log collection functions or as a Dedicated Log Collector that provides
a comprehensive log collection solution for the firewalls on your network. Using the M‐Series appliance as
a Log Collector allows for a more robust environment where the log collection process is offloaded to a
dedicated appliance. Using a dedicated appliance in a distributed log collection (DLC) deployment provides
redundancy, improved scalability, and capacity for longer term log storage.
In a DLC deployment, the Panorama management server (Panorama virtual appliance or an M‐Series
appliance in Panorama mode) manages the firewalls and the Log Collectors. Using Panorama, you configure
the firewalls to send logs to one or more Log Collectors. You can then use Panorama to query the Log
Collectors and provide an aggregated view of network traffic. In a DLC configuration, you can access the logs
stored on the Log Collectors from both the primary and secondary Panorama peers in a high availability (HA)
pair.
In the following topology, the Panorama peers in an HA configuration manage the deployment and
configuration of firewalls. This solution provides the following benefits:
Allows for improved performance in the management functions on Panorama
Provides high‐volume log storage on a dedicated hardware appliance
Provides horizontal scalability and redundancy with RAID 1 storage
Documents you may be interested
Documents you may be interested
