Paloalto firewall AD integration

Home > Enterprise security devices or applications > Paloalto firewall > AD integration

To integrate palo-alto firewall with AD use following steps:

1. Finding base DN of AD and also DN of authenticating service user
   1. Login into system connected to AD and open "Active Directory Users and Computers".
   2. Enable View -> "Advanced Features". Without this we cannot see LDAP attributed such as DN required for integration

      Other option is to use https://learn.microsoft.com/en-us/sysinternals/downloads/adexplorer to get base DN and DN for authenticating user

   3. Right click on the parent domain and choose "Properties"
   4. In "General" tab note the "Domain Name (pre-Windows 2000)". This DomainName value would be required during integration configuration in future steps. Eg Example
   5. Go to "Attribute Editor" tab
   6. Look for value against distinguishedName (DN). This is the base DN for the current AD server
   7. Create a normal service user whose password never expires (with strong long complex password) to integrate firewall with AD, if not created already
   8. Right click on the user and choose "Properties". Go to "Attribute Editor" tab and look for value of distinguishedName (DN) for the user. (This is optional. We can also just use AD username while integrating instead of specifying full DN for user).
2. Configure LDAP server profile using:
   1. Login into Paloalto firewall
   2. Go to "Device" -> "Server profle" -> "LDAP"
   3. Add a new LDAP server with desired profile name
   4. In server list add the server with IP or FQDN. Port can be 389 (Default) unless LDAPS has been enabled on the AD server.

      See Setup AD to respond to LDAP queries over LDAPS protocol if you need connectivity to AD over LDAPS

   5. In Server Settings use:

      Type

      Active Directory

      Base DN

      As noted in previous steps. Example dc=example,dc=com for example.com AD server

      Bind DN

      Bind DN of service user as noted in previous steps. For example "CN=paloalto,CN=Users,DC=example,DC=com"

      Password

      Password of the Bind DN user.

   6. Click "ok" to add LDAP server profile
3. Configure Group mapping for the LDAP server
   1. Login into Paloalto firewall
   2. Go to Device -> "User identification"
   3. Go to "Group Mapping Settings" tab
   4. Create a new "LDAP User mapping" with desired name
   5. For "Server Profile" select the LDAP server profile created in previous step
   6. Under "Domain setting" -> "User Domain" mention the domain name noted earlier. Eg Example
   7. Leave "Group Objects" Object Class to group and "User Objects" Object Class to person (Their default values).
   8. Ensure Enabled at bottom is selected
   9. Click ok.
   10. Commit
   11. After commit come again open the "Group Mapping Settings" created.
   12. Go to "Group Include List" tab.
   13. Select the AD groups that might be useful while configuring firewall policies such as "Captive Users Group", "VPN Users Group" etc. (Such groups dont exist in AD by default. We can create them as per requirement)
   14. Click ok
4. Create Authentication Profile based on LDAP server and Group mapping
   1. Go to "Device" -> "Authentication Profile"
   2. Create a new Authentication profile with desired Name
   3. For the Authetication Type choose "LDAP"
   4. For Server Profile choose the LDAP server profile created using above steps
   5. Leave Login Attribute to default sAMAccountName value
   6. User domain should be entered. For example Example.

      We entered similar domain name while creating "Group Mapping Setting" also

   7. Leave Username Modifier to its default value of %USERINPUT%
   8. Go to "Advanced" tab
   9. Add all the groups who should be allowed as part of this authentication profle.

      This way we can have one authentication profile for VPN Users with "VPN Users" AD group and another authentication profile for "Captive Portal" users with "Captive Portals" AD group.

   10. Click ok to Add authentication profile
5. (Optional) Create required local users and groups

   It is possible for firewall to get disconnected with AD due to policy or if AD is down. In such cases having at least a few local superusers is preferable for VPN / Captive portal authentication.

   1. Under "Device" -> "Local Users Database" -> "Users", create required users
   2. Under "Device" -> "Local Users Database" -> "User Groups" create a local group containing all local users
   3. Under "Device" - "Authentication Profiles" create a authentication profile of type "Local Database".
   4. For this "Local Database" authentication profile go to "Advanced" tab and select the local user group created in previous steps
   5. Click ok to complete creating a local authentication profile
6. (Optionally) Create authentication sequence where first local authentication is tried before trying AD authentication
   1. Go to "Device" -> "Authentication Sequence"
   2. Create a new "Authentication Sequence" of desired name
   3. Enable "Use domain to determine authentication profile"
   4. Select both local authentication profile (If created) and AD authentication profile as part of this sequence.

      Wherever we configure this authentication sequence both Local and AD authentication will be attempted in specified sequence

   5. Click ok

Test AD integration with Admin roles

Easiest way to check whether AD authentication is working or not before configuring VPN (Global Protect) or Captive portal, is to enable AD based login into the firewall as administrator. If that works then we know AD integration is working as expected before we configure VPN or captive portal.

To add a AD user as admin (Perhaps just for testing AD integration, we can delete this entry later, if required) use:

1. Login into Paloalto firewall
2. Go to "Device" -> "Administrators"
3. Click "Add" and type only the username without domain name in Name field
4. Authentication profile can be "AD authentication profile" created above or we can also choose "Authentication Sequence" created above. But while testing we should have the specified user only in AD and not in local firewall users group to ensure that test is conducted properly. Hence use a username which is only in AD and not in local paloatlo user database.
5. Administrator type will be dynamic with "Superuser" role
6. Click ok
7. Commit
8. Open the firewall in a incognito window (or different browser) and validate whether AD login with specified user is working or not.
9. (Optionally) delete the test admin user created for AD integration testing

Configure Global Protect VPN portal for client setup download

The paloalto firewall has GlobalProtect VPN portal where users can login and download the end user VPN client / agent. It also has Global Protect VPN Gateway. Once agent is configured and installed, it communicated with Global Protect Gateway during VPN connectivity. Hence both might be required.

To configure Global Protect VPN portal use:

1. Login into Paloalto firewall
2. Go to "Network" -> "Global Protect" -> "Portals"
3. Add a new portal with desired name
4. Select the public IP interface on which VPN portal will listen
5. In "Authentication tab" under "Client Authentication" click "Add"
   1. Give any desired name for Client authentication
   2. Leave OS to be any
   3. Under authentication profile choose Authentication Sequence (Or profile) desired for VPN login authentication
   4. For "Allow authentication with User Credentials OR Client Certificate" value should be "Yes (User Credentials or Client Certificate Required)"
   5. Click ok
6. In "Agent" tab, under 'Agent' click Add
   1. Choose required name for Agent
   2. Under 'Config selection criteria' tab leave OS as any
   3. Under Groups select "VPN users" group from AD
   4. Under "External Gateways" add the gateway with public IP of the ethernet interface selected while creating this portal
   5. Click ok to Add agent
7. Click ok to create portal
8. Commit and test https://<portal-ip-or-fqdn> using some other Internet connectivity (not via the firewall while connected to LAN zone) and try login with AD username and password

Configure Global Protect VPN gateway for VPN connectivity

As explained portal is only for download of agent. We need to configure Gateway for VPN to work. To configure Global protect VPN gateway use:

1. Login into Paloalto firewall
2. Go to "Network" -> "Global Protect" -> "Gateways"
3. Add a new gateway with desired name
4. Select the public IP interface on which VPN gateway will listen

   Ideally setup Global protect on loopback and forward (DNAT) public IP ports to loopback ports 443 (for VPN) / 8443 (for admin UI). This plays better when we need active/active VPN from two ISPs or when we need to change VPN port from 443 to something else.

5. In "Authentication tab" under "Client Authentication" click "Add"
   1. Give any desired name for Client authentication
   2. Leave OS to be any
   3. Under authentication profile choose Authentication Sequence (Or profile) desired for VPN login authentication
   4. For "Allow authentication with User Credentials OR Client Certificate" value should be "Yes (User Credentials or Client Certificate Required)"
   5. Click ok
6. In "Agent" tab, under "Tunnel Settings" enable tunnel mode
   1. Give name of a unused tunnel eg tunnel.1
   2. Enable IPSec
   3. In Agent tab under "Client Settings" click Add
      1. Give desired name for client settings
      2. Under Source user, select AD "VPN users" group
      3. Leave OS to be default any
      4. Under "IP Pools" tab, "IP Pools" setting add a IP pool not used anywhere in the organization (ideally not used anywhere in other branches also)
      5. Under "split tunnel" -> "Access route" ensure that "No direct access to local network" is not selected
      6. Add local Subnets under include
      7. Add 0.0.0.0/0 under Exclude
      8. Click ok to add "client settings"
   4. Click ok to create Global protect gateway configuration
7. Commit and test by connecting to VPN using some other Internet connectivity (not via the firewall while connected to LAN zone) and try login with AD username and password

   Test connecting to local included subnets and see that they are accessible

   Optionally traceroute to some Internet machine and validate that Internet traffic is going directly and not over VPN due to split tunnel configuration

Troubleshoot GP VPN issues

Ensure following while deploying VPN (Global protect) to avoid VPN issues:

• If the VPN is via one ISP, then we should not have Policy based forwarding (PBF) for VPN client IP destination through another ISP. If there is PBF for another ISP, we must add negative (!) destination towards VPN client IP pool in that rule to ensure that PBF is not applied for VPN clients.
• There should not be any existing DNAT on port 443 for the configured ISP public IP. Ideally as mentioned preferably use a loopback IP / interface for setting up Global Protect gateway and portal. This plays better when we need active/active VPN across multiple ISPs or if we need to change VPN port from default 443.
• If there is common ISP between VPN client location and VPN server location with large subnet eg /19 then that might also cause problems in connecting to VPN. In one case we had VPN configured on a ISP (Say ISP1 for a customer). That customer also had another ISP - ISP2 with /19 subnet. Then we were trying to connect to VPN from a office with similar ISP2 connection with similar /19 subnet. Unfortunately while forward packets to VPN server were going from ISP2 at office to ISP1 at client location, since the client also had ISP2, the reply packets for us were being returned via ISP2 of customer (as we had a common /19 interface).
• No VPN or Global protect license is required when users connect to PA firewall from Windows. There is no need of corresponding license to be shown under Device -> Licenses for VPN to work.

Home > Enterprise security devices or applications > Paloalto firewall > AD integration