Building Blocks of an Authentication Policy Rule
Table of Contents
Expand all | Collapse all
-
- Firewall Overview
- Features and Benefits
- Last Login Time and Failed Login Attempts
- Message of the Day
- Task Manager
- Language
- Alarms
- Commit Changes
- Save Candidate Configurations
- Revert Changes
- Lock Configurations
- Global Find
- Threat Details
- AutoFocus Intelligence Summary
- Configuration Table Export
- Change Boot Mode
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Packet Broker Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > Interfaces > PoE
- Network > Interfaces > Cellular
- Network > Interfaces > Fail Open
- Network > VLANs
- Network > Virtual Wires
-
- Network > Routing > Logical Routers > General
- Network > Routing > Logical Routers > Static
- Network > Routing > Logical Routers > OSPF
- Network > Routing > Logical Routers > OSPFv3
- Network > Routing > Logical Routers > RIPv2
- Network > Routing > Logical Routers > BGP
- Network > Routing > Logical Routers > Multicast
-
- Network > Routing > Routing Profiles > BGP
- Network > Routing > Routing Profiles > BFD
- Network > Routing > Routing Profiles > OSPF
- Network > Routing > Routing Profiles > OSPFv3
- Network > Routing > Routing Profiles > RIPv2
- Network > Routing > Routing Profiles > Filters
- Network > Routing > Routing Profiles > Multicast
- Network > Proxy
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
- Network > Network Profiles > MACsec Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > ACE
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > IoT Security > DHCP Server Log Ingestion
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > SCP
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation > IoT
- Device > Policy > Recommendation SaaS
- Device > Policy Recommendation > IoT or SaaS > Import Policy Rule
-
- Device > User Identification > Connection Security
- Device > User Identification > Terminal Server Agents
- Device > User Identification > Group Mapping Settings
- Device > User Identification> Trusted Source Address
- Device > User Identification > Authentication Portal Settings
- Device > User Identification > Cloud Identity Engine
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Firewall Clusters
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
- Panorama > Device Registration Auth Key
Building Blocks of an Authentication Policy Rule
Whenever a user requests a resource (such as when visiting
a web page), the firewall evaluates Authentication policy. Based on
the matching policy rule, the firewall then prompts the user to
respond to one or more challenges of different factors (types),
such as login and password, voice, SMS, push, or one-time password
(OTP) authentication. After the user responds to all the factors,
the firewall evaluates Security policy (see Policies
> Security) to determine whether to allow access to the resource.
The firewall does not prompt users to authenticate if they
access non-web-based resources (such as a printer) through a GlobalProtect™ gateway
that is internal
or in tunnel mode. Instead, the users will see connection failure
messages. To ensure users can access these resources, set up an
authentication portal and train users to visit it when they see
connection failures. Consult your IT department to set up an authentication
portal.
The following table describes each building block or component
in an Authentication policy rule. Before you Add a
rule, complete the prerequisites described in Create
and Manage Authentication Policy.
Building Blocks in an Authentication
Rule | Configured In | Description |
---|---|---|
Rule number | N/A | Each rule is automatically numbered and
the order changes as rules are moved. When you filter rules to match
specific filters, the PoliciesAuthentication page lists each
rule with its number in the context of the complete set of rules
in the rulebase and its place in the evaluation order. For details,
see rule sequence and its evaluation order |
Name |
General
| Enter a name to identify the rule. The name
is case-sensitive and can have up to 63 characters, which can be
letters, numbers, spaces, hyphens, and underscores. The name must
be unique on a firewall and, on Panorama, unique within its device group
and any ancestor or descendant device groups. |
Description | Enter a description for the rule (up to
1024 characters). | |
Tag | Select a tag for sorting and filtering rules
(see Objects
> Tags). | |
Group Rules by Tag | Enter a tag with which to group
similar policy rules. The group tag allows you to view your policy rule
base based on these tags. You can group rules based on a Tag. | |
Audit Comment | Enter a comment to audit the
creation or editing of the policy rule. The audit comment is case-sensitive
and can have up to 256 characters, which can be letters, numbers,
spaces, hyphens, and underscores. | |
Audit Comment Archive | View previous Audit Comments for
the policy rule. You can export the Audit Comment Archive in CSV format. | |
Bypass Web Proxy Authentication | Select this option to allow traffic that matches this policy rule to
Bypass Web Proxy Authentication traffic. If you select this option, you must select an address object that contains the source IP addresses
of your trusted devices, a custom URL category that contains the destination IP
addresses of your trusted devices, or both. | |
Source Zone | Source | Add zones to apply the
rule only to traffic coming from interfaces in the zones that you
specify (default is any). To define
new zones, see Network
> Zones. |
Source Address | Add addresses or address
groups to apply the rule only to traffic originating from the sources
that you specify (default is any). Select Negate to choose
any address except the selected ones. To define new address
or address groups, see Objects
> Addresses and Objects
> Address Groups. | |
Source User | User | Select the source users or user groups to which
the rule applies:
If
the firewall collects user information from a RADIUS, TACACS+, or
SAML identity provider server and not from the User-ID™ agent, the
list of users does not display; you must enter user information
manually. |
Source HIP Profile | Add host information profiles
(HIP) to enable you to collect information about the security status
of your end hosts, such as whether they have the latest security
patches and antivirus definitions. For details and to define new HIPs,
see Objects
> GlobalProtect > HIP Profiles. | |
Destination Zone | Destination | Add zones to apply the
rule only to traffic going to interfaces in the zones that you specify
(default is any). To define new zones, see Network
> Zones. |
Destination Address | Add addresses or address
groups to apply the rule only to the destinations that you specify
(default is any). Select Negate to choose
any address except the selected ones. To define new address
or address groups, see Objects
> Addresses and Objects
> Address Groups. | |
Service | Service/URL Category | Select from the following options to apply
the rule only to services on specific TCP and UDP port numbers:
|
URL Category | Select the URL categories to which the rule applies:
| |
Authentication Enforcement | Actions | Select the authentication enforcement object (Objects
> Authentication) that specifies the method (such as Authentication
Portal or browser challenge) and authentication profile that the
firewall uses to authenticate users. The authentication profile
defines whether users respond to a single challenge or to multi-factor authentication
(see Device
> Authentication Profile). You can select a predefined or custom
authentication enforcement object. If you must exclude
hosts or servers from a Authentication Portal policy, add them to
an Authentication Profile that specifies no-captive-portal as
the Authentication Enforcement. However,
Authentication Portal policies help the firewall learn user-to-IP-address mapping
and should be used when possible. |
Timeout | To reduce the frequency of authentication challenges
that interrupt the user workflow, you can specify the interval in
minutes (default is 60) when the firewall prompts the user to authenticate
only once for repeated access to resources. If the Authentication Enforcement object
specifies multi-factor authentication, the user must authenticate
once for each factor. The firewall records a timestamp and reissues
a challenge only when the timeout for a factor expires. Redistributing Timeout is
a tradeoff between tighter security (less time between authentication
prompts) and the user experience (more time between authentication prompts).
More frequent authentication is often the right choice for access
to critical systems and sensitive areas such as a data center. Less
frequent authentication is often the right choice at the network perimeter
and for businesses for which the user experience is key. For
perimeter resources, set the value to 480 minutes (8 hours) and
for data center resources and critical systems, set a lower value
such as 60 minutes to tighten security. Monitor and adjust the values
as necessary. | |
Log Authentication Timeouts | Select this option (disabled by default)
if you want the firewall to generate Authentication logs
whenever the Timeout associated with an authentication
factor expires. Enabling this option provides more data to troubleshoot
access issues. In conjunction with correlation objects, you can
also use Authentication logs to identify suspicious activity on
your network (such as brute force attacks). Enabling
this option increases log traffic. | |
Log Forwarding | Select a Log Forwarding profile if you want
the firewall to forward Authentication logs
to Panorama or to external services such as a syslog server (see Objects
> Log Forwarding). | |
Any (target all devices) Panorama only | Target | Enable (check) to push the policy rule to
all managed firewalls in the device group. |
Devices Panorama only | Select one or more managed firewalls associated
with the device group to push the policy rule to. | |
Tags Panorama only | Add one or more tags
to push the policy rule to managed firewalls in the device group
with the specified tag. | |
Target to all but these specified devices
and tags Panorama only | Enable (check) to push the policy rule to
all managed firewalls associated with the device group except for
the selected device(s) and tag(s). |