©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
73
Set
Up
Panorama
Set
Up
Administrative
Access
to
Panorama
Set
Up
Administrative
Access
to
Panorama
By
default,
Panorama
includes
a
default
administrative
account
(admin),
with
full
read
‐
write
access
to
all
the
functionality
on
Panorama.
As
a
best
practice,
create
a
separate
administrative
account
for
each
person
who
needs
access
to
the
administrative
or
reporting
functions
of
Panorama.
This
prevents
unauthorized
configuration
(or
modification)
and
enables
logging
of
the
actions
of
each
individual
administrator.
Panorama
allows
you
to
define
and
restrict
access
as
broadly
or
granularly
as
required,
depending
on
the
security
requirements
within
your
organization.
For
example,
you
may
decide
that
a
datacenter
administrator
can
have
access
to
all
the
device
and
networking
configuration,
while
a
security
administrator
can
have
control
over
security
policy
definition,
the
log
viewer
and
reporting,
and
other
key
individuals
can
have
limited
CLI
or
XML
API
access.
The
following
topics
describe
how
to
configure
administrative
accounts
and
set
up
basic
administrative
access.
For
information
on
the
different
options
available
to
authenticate
administrative
users,
see
Create
an
Administrative
Account
An
administrative
user
must
have
an
account
and
be
assigned
to
a
role
.
The
role
defines
the
type
of
access
the
associated
administrator
has
to
Panorama;
you
can
assign
the
administrative
user
to
a
built
‐
in
Dynamic
Role
or
to
a
custom
role
(Admin
Role
Profile)
that
you
define.
If
you
plan
to
use
Admin
Role
Profiles
rather
than
Dynamic
Roles,
create
the
profiles
that
define
what
type
of
access,
if
any,
to
give
to
the
different
sections
of
the
web
interface,
the
CLI,
and
XML
API
for
each
administrator
assigned
to
the
role.
For
more
information
on
roles,
see
.
For
each
administrative
user
you
can
also
define
the
minimum
password
complexity,
a
password
profile,
and
use
an
authentication
profile
to
use
an
external
authentication
service
to
validate
the
administrator’s
credentials.
If
you
are
defining
role
‐
based
administrative
access
on
Panorama,
read
‐
only
access
to
the
Device
Groups
and
Templates
nodes
must
be
provided
in
order
for
the
administrators
to
commit
their
changes
to
Panorama.
If
you
are
upgrading
from
an
earlier
version
of
Panorama,
the
upgrade
process
provides
read
‐
only
access
to
the
Device
Groups
and
Templates
nodes.
The
following
example
explains
how
to
create
a
local
administrator
account
with
local
authentication:
You
cannot
add
an
administrative
account
to
an
M
‐
100
appliance
in
Log
Collector
mode.
Only
the
default
administrative
user
account
with
the
default
username
admin
is
available.
