Palo Alto Networks GlobalProtect VPN using Microsoft Azure AD & SAML
ฝัง
- เผยแพร่เมื่อ 5 ก.ย. 2024
- This video provides an overview of the complete solution as well as a configuration walkthrough and helpful validation steps. It also covers how to use transforms in Azure AD to support both hybrid AD and Guest accounts.
![เปิดใจ พี่ญา คนรุม หลังทัวร์ลง หนักสุดในชีวิต!! l [Nickynachat]](http://i.ytimg.com/vi/2-OJZRtclro/mqdefault.jpg)
![ตีสิบเดย์ [FULL] | ตัวตึง! ปากกล้า! ท้ารบ! "ทนายไพศาล เรืองฤทธิ์"](http://i.ytimg.com/vi/pU3dXTsaBVc/mqdefault.jpg)
I usually don't comment much on videos but I had to tell you that you made my day, great instructional video for Palo Alto SAML GP authentication configuration. You're an excellent teacher and I appreciate the tips for the guest users as well. Please keep them coming, I know its time consuming sometimes to create videos and post on youTube. Know that the content you push out is valuable and very much appreciated to people. Works like a charm after following your guide.
I cannot stress enough how useful your video has been for me wrt to Azure guest accounts (non -AD users). I have been struggling with this issue for 2 weeks, logging tickets with TAC and asking colleagues to help with the issue.
Your advice at 10:35 and again later in the video regarding the #EXT# added to guest account logins was exactly what I needed.
Also, the rest of your video is stellar in the way it is outlined. Very useful information portrayed in a straight forward easy to follow guide.
Thank you!
it WORKED thank you! I had to add :443 to my SAML Identifer and reply/URL's but it worked. you're a GENIUS. no way I could have even come close to making this work without your video, thank you!
FYI, MFA from my SAML-Azure worked perfect. Thanks great video.
Very good and how did you enable it, we are not getting it here. Thank you!
Can you help me with this, which settings in the AAD and GP gateway worked for you?
Great video on saml auth in GlobalProtect and Azure. Now to figure out how to configure GP Always On with Azure AD.
This.... worked. First time. I... I.... I don't think that's ever happened to me before. Like, I configured it for production while watching the video. And ...... it worked.
I need to re-assess my life.
Super video for this complicated process. Thanks!!!
Great Video which has helped us.. On a side note.. We currently also have users that use a third-party vpn client ( IOS/Android ) and Linux OS as we currently don't have a globalprotect subscription. We use azure MFA with our windows and mac clients but for the native vpn clients this process is not working ? How do we setup a third-party vpn client to prompt for MFA authentication ?
You always make such great videos! You are an asset to Palo Alto.
How do I get it to fall back to a local account? For instance SAML is down for some reason (cert expired?) and an admin needs to get in via the VPN as they are on vacation or something. I can't seem to setup an auth-sequence for fallback.
Great video. Can you point me in the right direction for steps on downloading my organization's certificate and importing it into the firewall to validate the SAML provider?
Thanks for great video so who is sending the SAML Insertion response here? Does SAML assertion happen when auth is successfull?
Thank you very much! Excellent video...
Hey! Thank you for such a great video!
In the agenda, you have mentioned that "I'll be using P2 to use groups", did I miss this part in the video?
It's a subscription tier within Azure AD, Premium P2. It's going to be part of most organizational plans already so I didn't go into enabling it, but you can find out more about it here: azure.microsoft.com/en-us/pricing/details/active-directory/
We have the SAML component working. We end up with a successful SAML authentication, but no agent configuration is chosen. The UPN format doesn't seem to be matching any of the group mappings, even though we've set userPrincipalName on the group mapping attributes. We've validated that the LDAP profiles are working, and that the firewall is pulling the userPrincipalName attribute. Any tips on this? The use case is applying different portal agent configs to users based on their AD group.
Check to see if the user name provided matches the user attributes and group members that you are looking for. GlobalProtect uses the "@" as a domain distinguisher so kelly@learningforfun.net will show up as learningforfun.net\kelly.
Four quick commands to check:
less mp-log sslvpn-access/sslvpn-access.log
#from here you can see the user-id that the web-server process was seeing along.
show user ip-user-mapping all
#see what the user is registered with GP as currently.
show user user-attributes user all
# This will show you the user attributes such as alternatives to how the user name shows up
show user group name [DOMAIN NAME]
This will show you the group members to verify that they match one of the user attributes. Example:
show user group name "learningforfun
emote users"
Great Video! When you have multiple FQDN's for GP gateways that differ from the portal FQDN, is there a way to add the multiple Entity ID's and Reply URL's in the same Azure AD enterprise application?
Yep, you can add additional entries under the Single sign-on area. Put each SP in the Identifier area and the ACS in the Reply URL and your good to go.
Thanks for the great explain
If we will have MFA with Radius Server, the authentication now will be the Active Directory and not the local user?
I have this working but it only asked me to enter credentials and then subsequent MFA on first login. Now if I disable and re-enable it just auths straight away with no credentials or MFA request. How do I at least ask for one of these? I only have azure basic so hoping it's not reliant on conditional access
Great Video! Nicely done!! :)
can I add MFA with authenticator to this configurations?
Yes you can. That's what it defaults to for the basic access I believe when you onboard accounts. Just scan the QR code in the Authenticator app and you are off and running.
this is my doubt too, here we are only getting SSO but I want to put the Authenticator as MFA
@@gustavoassi1016 I'd guess conditional policy toward the azure gp app and then force sso on it
@@learningforfuntoday ... would be GREAT to see a video on MFA with authenticator and Azure
This is awesome!! Thank you!
Hi, did you have a chance to make the video about implementing Cloud Identity Engine? I'm thinking to make the upgrade to 10.1 if this will be the solution for my problems.
Should be up and finished by the 2nd of December.
Help i feel like i'm 95% there but cant get connected. i have an open ticket with support and they havent been able to help me.
Thanks for the video, with this SSO configuration, can I implement validation with MS Autenthicator, to do MFA?
Absolutely, by default it's enabled for accounts using the free tier of Azure AD.
@@learningforfuntoday Yes, MFA is enabled for the account in AAD, but in global protect it does not ask for validation in the Autenthicator, we integrate the GP gateway with AAD via SAML, it does SSO but not MFA.
What's up if we chance the port of the URL of the Palo Alto, for example to a 5443, it still works?
Yes, you would edit the :443 to match the port (e.g. :5443). This info is to let the provider know where the client is being redirect from and where to redirect them back to after they successfully get a SAML assertion message.
How to find out that a GP user in prelogon stage unable to proceed to connect further due to authentication issue caused by azure AD/SAML authentication? How to verify that in case when we get the troubleshooting logs ??
During the transition from prelogon to the user session you'll see the details of the attempt in the Azure App log. Same as if they were connecting from the app from the desktop. If you aren't seeing anything I'd check your tunnel transition timer setting.
Thanks for the great video! Very helpful. At 12:10 when you’re about to download the XML to import into the Palo Alto SAML IDP Profile. Do you know if we can import a wildcard certificate into the SAML signing certificate area on Microsoft so we can do the validation check in the SAML IDP on the Palo?
Hi, I tested this morning and was able to upload and use sub-domain wildcard cert (e.g. *.learningforfun.net). I would recommend caution to using wildcard cert for signing on production apps, just something to consider.
@@learningforfuntoday thanks! I appreciate you testing that!! I’m not sure what work around options I have. We want to have two gateways (primary and backup). Primary on ISP1and backup on ISP2, with different URLs (as we don’t have DNS failover). Since we are “validating” with the certificate via the SAML IDP on the Palo. This way we can have both gateways with different URLs. We leverage the conditional access on the GlobalProtect VPN app in Azure for MFA. I thought choosing the validate option was “best practice” to make it more secure. Maybe I’m wrong….
@@davec544 Validating is absolutely the best practice. The certificate that's signing the SAML assertion is just a name (something friendly, I tend to name it after the app purpose) that the Palo will need to trust. This doesn't need (and shouldn't) match your portal/gateway address.
Under the Enterprise App theirs the is the Base SAML Configuration. This is where you can have multiple entries or use a wildcard like: *.learningforfun.net vs. vpn[1|2].learningforfun.net.
Hopefully I understood your ask, but this is how I've handled deployments with multiple portal/gateway deployments.
@@learningforfuntoday oh! I thought it needed to match the portal/gateway address (URL). So I created a certificate on the Palo with the URL of the portal/gateway and then imported it in the SAML Signing certificate area. So what you’re saying is the common name of the certificate that I creat and import into the SAML Signing Certificate can be anything? So that’s just required to validate the “handshake” (so to speak)? I knew I could put the other URLs in the base SAML config., but I thought it required a valid URL. Hmm Interesting
I’ll have to try that tonight. Unfortunately, it’s in production and I can’t test changes until tonight. I really appreciate the help!
Great video :-) Can I just throw a conditional access policy in to use force the use of MFA through the authenticator app?
You absolutely can and what I would recommend. It's as easy as saying all users must use MFA. The only real issue I've seen is where customers set the tenant wide setting that cache MFA status for 12 hours....so after the user connects the fist time Azure caches it for 12 hours on it's side. Just be careful when testing it out to make sure you the conditional access policy matches your security requirements!
@@learningforfuntoday it isn't going quite as smoothly as in your video lol. I see this error( description contains 'failed authentication for user \'xxxxxxx\'. Reason: Internal error, e.g. network connection, DNS failure or remote server down. auth profile \Azure AD - Global Protect'\', vsys \'vsys1\', From: xxxxx.' ) and this error 'Username from SAML SSO response is different from the input' I think i will try update the group mapping attributes to include userprinciple Name and samaccountname and see if that helps.
@@reddrinker Try the email field as the username. You'll get that message if the attributes being returned as the username aren't the email address. I ran into it when I was using a Guest invited account since the UPN adds #EXT# to it.
I was able to see it easily by using a tool called SAML Tracer in Chrome and FireFox and logging into the Portal.
Hi, great video, indeed! I have a problem regarding switching from local user authentication method to azure ad using SAML in a on-prem PA firewall. I already have security policy defined in the firewall for each user groups. I'm not able to create the same policies for the azure ad users/groups. Did you know a way how it could be done? Thanks!
You'll want to make sure the username being returned matches the LDAP user/group attributes you are pulling from AD. Most of the time this should be the email attribute that we use as a secondary attribute.
Alternatively, if you are on 10.1 you can use the Cloud Identity Engine to query the groups directly from Azure and on prem AD. Highly recommend looking into this.
I plan on making a video here shortly on how to implement it.
@@learningforfuntoday I don't have a local AD, I have just some users and groups defined in PA firewall. All that users connect to VPN from outside the office using GP. Now works well, each group follows security policy, but If I will switch to azure I don't know how will work. Thanks!
@@learningforfuntoday pls make the cloud identity engine implementation video. And thanks for making this one btw, very helpful
The best part of IT is waiting around 😁😁🤣😂
How do I assign groups and permission to a user who is being authenticated by SAML at the firewall
Two different options:
1) You can use the LDAP Group mapping capabilities of the firewall like you do for other group mappings. This works if there's no cloud only account (e.g. guest accounts).
2) The new way to do it would be to use the Cloud Identity Engine (CIE) that Palo Alto Networks offering in the hub (apps.paloaltonetworks.com). It pulls the groups from AD and from iDPs like Azure and sync's them with your firewalls! Perfect for the type of deployments we are seeing today.
I'll have a video coming out soon that dives more into the benefits and how to deploy the CIE solution.
@@learningforfuntoday Where is this video? I am in the same boat as some other commenters. Our Group Mapping worked fine and then I switched over to Azure. I have CIE setup with my LDAP and Azure directories both connected. I guess I need to add this to my (non-panorama) firewall somehow..
GREAT video! Is it mandatory @9:37 to add the :443 to both the Identifier and Reply URL? If yes, why?? Thanks