76
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Set
Up
Administrative
Access
to
Panorama
Set
Up
Panorama
If
you
are
using
an
external
authentication
server,
create
a
server
profile
(
Panorama > Server Profiles
)
before
creating
an
authentication
profile.
Panorama
requires
the
server
profile
to
access
the
authentication
service.
Define
an
Authentication
Sequence
An
authentication
sequence
is
an
ordered
list
of
authentication
profiles
that
allows
the
use
of
more
than
one
authentication
service.
Authentication
sequences
provide
flexibility
in
environments
where
multiple
databases
exist
for
different
users
and
user
groups.
When
defining
an
authentication
sequence,
Panorama
attempts
to
authenticate
the
administrator
using
each
of
the
configured
server
profiles
in
sequence.
For
example,
an
authentication
sequence
can
instruct
Panorama
to
check
LDAP
first,
RADIUS
next,
and
the
local
database
last,
until
a
successful
authentication
occurs;
if
it
fails,
the
administrator
is
denied
access.
Create
an
Authentication
Profile
Step
1
Create
an
authentication
profile.
1.
Select
Panorama > Authentication Profile
and
then
click
Add
.
2.
Enter
a
user
Name
to
identify
the
authentication
profile.
Step
2
Define
the
conditions
for
locking
out
the
administrative
user.
1.
Enter
the
Lockout Time
.
This
is
the
number
of
minutes
that
a
user
is
locked
out
upon
reaching
the
maximum
number
of
failed
attempts
(0
‐
60
minutes;
default
0).
0
means
that
the
lockout
is
in
effect
until
it
is
manually
unlocked.
2.
Enter
the
Failed Attempts
count.
This
is
the
number
of
failed
login
attempts
that
are
allowed
before
the
account
is
locked
out
(1
‐
10;
default
0).
By
default,
the
failed
attempt
count
is
0
and
the
user
is
not
locked
out
despite
repeated
failure
to
authenticate.
Step
3
Specify
the
users
and
groups
that
are
explicitly
allowed
to
authenticate.
By
adding
an
allow
list
to
an
authentication
profile,
you
can
limit
access
to
specific
users
in
a
user
group/directory.
For
the
Allow List
,
pick
one
of
the
following:
•
Select
the
All
check
box
to
allow
all
users.
•
Click
Add
and
enter
the
first
few
characters
of
a
name
in
the
field
to
list
all
the
users
and
user
groups
that
start
with
those
characters.
Repeat
to
add
as
many
users/user
groups
as
required.
Step
4
Select
the
authentication
service
and
attach
the
server
profile.
1.
In
the
Authentication
drop
‐
down,
select
the
type
of
authentication
you
will
use.
2.
Select
the
appropriate
server
profile
in
the
Server Profile
drop
‐
down.
Step
5
Commit
your
changes.
Click
Commit
,
and
select
Panorama
in
the
Commit Type
option.
