Alto MS Series User Manual download pdf (Page 19)

Getting Started Guide 15

Integrate the Firewall into Your Management Network Add Firewall Administrators

Add Firewall Administrators

By default, every Palo Alto Networks firewall comes preconfigured with a default administrative account

(admin), which provides full read-write access (also known as superuser access) to the firewall.

The following sections describe the various ways you can set up administrative accounts and provide procedures

for setting up basic administrative access:

 Administrative Roles

 Administrative Authentication

 Create an Administrative Account

Administrative Roles

The way you configure administrator accounts depends on the security requirements within your organization,

whether you have existing authentication services you want to integrate with, and how many different

administrative roles you require. A role defines the type of access the associated administrator has to the system.

There are two types of roles you can assign:

 Dynamic Roles—Built-in roles that provide Superuser, Superuser (read-only), Device administrator,

Device administrator (read-only), Virtual system administrator, and Virtual system administrator (read-only)

access to the firewall. With dynamic roles, you don’t have to worry about updating the role definitions as new

features are added because the roles automatically update.

 Admin Role Profiles—Allow you to create your own role definitions in order to provide more granular

access control to the various functional areas of the web interface, CLI and/or XML API. For example, you

could create an Admin Role Profile for your operations staff that provides access to the device and network

configuration areas of the web interface and a separate profile for your security administrators that provides

access to security policy definition, logs, and reports. Keep in mind that with Admin Role Profiles you must

update the profiles to explicitly assign privileges for new features/components that are added to the product.

Administrative Authentication

There are four ways you can authenticate administrative users:

 Local administrator account with local authentication—Both the administrator account credentials and

the authentication mechanisms are local to the firewall. You can further secure the local administrator

account by creating a password profile that defines a validity period for passwords and by setting device-wide

password complexity settings.

As a best practice, create a separate administrative account for each person who needs access

to the administrative or reporting functions of the firewall. This allows you to better protect the

firewall from unauthorized configuration (or modification) and to enable logging of the actions of

each individual firewall administrator.

1 2 ... 14 15 16 17 18 19 20 21 22 23 24 ... 107 108

No comments

Alto MS Series User Manual Page 19