©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
23
Panorama
Overview
Role
‐
Based
Access
Control
Admin
Role
Profiles
—To
provide
more
granular
access
control
over
the
functional
areas
of
the
web
interface,
CLI,
and
XML
API,
you
can
create
custom
roles.
When
new
features
are
added
to
the
product,
you
must
update
the
roles
with
corresponding
access
privileges:
Panorama
does
not
automatically
add
new
features
to
custom
role
definitions.
When
creating
a
custom
role
(see
),
you
select
one
of
the
following
profiles:
Authentication
Profiles
and
Sequences
Among
its
other
uses,
an
authentication
profile
defines
how
an
administrative
user
is
authenticated
on
Panorama
upon
login.
If
you
create
a
local
user
account
on
Panorama,
you
can
authenticate
the
user
to
the
local
database,
or
use
an
external
RADIUS,
LDAP,
or
Kerberos
server
for
authentication.
If
you
do
not
want
to
create
a
local
user
account,
and
want
to
manage
both
account
administration
and
authentication
using
an
external
authentication
mechanism,
you
must
use
RADIUS.
For
a
high
‐
level
overview
of
the
process,
see
To
authenticate
to
multiple
authentication
sources—local,
RADIUS,
LDAP,
and/or
Kerberos—define
an
authentication
sequence.
An
authentication
sequence
is
a
ranked
order
of
authentication
profiles
that
an
administrative
user
is
matched
against.
Panorama
checks
against
the
local
database
first,
and
then
each
profile
in
sequence
until
the
user
is
successfully
authenticated.
The
user
is
denied
access
to
Panorama
only
if
authentication
fails
for
all
the
profiles
defined
in
the
authentication
sequence.
To
create
authentication
profiles
and
sequences,
see
and
Administrator
Role
Profile Description
Panorama
For
these
roles,
you
can
assign
read
‐
write
access,
read
‐
only
access,
or
no
access
to
all
the
Panorama
features
that
are
available
to
the
superuser
dynamic
role
except
the
management
of
Panorama
administrators
and
Panorama
roles.
For
the
latter
two
features,
you
can
assign
read
‐
only
access
or
no
access,
but
you
cannot
assign
read
‐
write
access.
An
example
use
of
a
Panorama
role
would
be
for
security
administrators
who
require
access
to
security
policy
definitions,
logs,
and
reports
on
Panorama.
Device
Group
and
Template
For
these
roles,
you
can
assign
read
‐
write
access,
read
‐
only
access,
or
no
access
to
the
device
groups
and
templates
specified
in
the
administrator
account
definition.
Roles
with
this
profile
have
the
following
limitations:
•
No
access
to
the
CLI
or
XML
API
•
No
access
to
configuration
or
system
logs
•
No
access
to
App
Scope
or
reports
•
No
access
to
VM
information
sources
•
In
the
Panorama
tab,
access
is
limited
to
device
deployment
features
(read
‐
write,
read
‐
only,
or
no
access)
and
to
the
templates,
managed
devices,
and
device
groups
specified
in
the
administrator
account
(read
‐
only
or
no
access).
An
example
use
of
this
role
would
be
for
administrators
in
your
operations
staff
who
require
access
to
the
device
and
network
configuration
areas
of
the
web
interface
for
specific
device
groups
and/or
templates.
