©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
77
Set
Up
Panorama
Set
Up
Administrative
Access
to
Panorama
Configure
Administrative
Authentication
Administrators
can
authenticate
locally
to
Panorama
using
passwords
or
certificates,
or
they
can
authenticate
to
an
external
authentication
server.
There
are
three
options
for
setting
up
administrative
authentication
on
Panorama:
Create
a
local
user
account
and
authenticate
locally.
Authentication
can
be
password
‐
based,
certificate
‐
based,
or
key
‐
based.
See
,
and
.
Create
a
local
user
account
but
authenticate
to
an
external
RADIUS/LDAP/Kerberos
server
using
authentication
profiles:
–
Create
a
server
profile
using
the
Panorama > Server Profile
pages.
Each
external
service
with
which
Panorama
must
interact
requires
a
server
profile.
The
server
details
required
to
establish
the
connection
with
Panorama
depend
on
the
authentication
service
you
plan
to
use.
–
Create
an
authentication
profile.
See
.
–
(Role
‐
based
access
only)
Define
an
Admin
Role
Profile
that
specifies
whether
the
user
has
access
to
Panorama
or
Device
Groups
and
Templates;
see
For
dynamic
roles,
an
Admin
Role
Profile
is
not
required.
Use
RADIUS
Vendor
Specific
Attributes
(VSAs)
for
managing
administrative
access
to
Panorama.
Use
this
option
if
you
do
not
want
to
create
a
local
account
on
Panorama
for
an
administrative
user,
and
would
like
to
use
your
current
infrastructure
to
manage
authentication
and
password
management
on
a
RADIUS
server.
For
a
high
‐
level
overview
of
the
process,
see
Define
an
Authentication
Sequence
Step
1
Create
an
authentication
sequence.
1.
Select
Panorama > Authentication Sequence
and
then
click
Add
.
2.
Enter
a
user
Name
to
identify
the
authentication
sequence.
3.
Click
Add
to
select
the
chronological
sequence
of
authentication
profiles
against
which
the
administrator’s
credentials
must
be
checked.
Step
2
(Optional)
Define
the
conditions
for
locking
out
the
administrative
user.
1.
Enter
the
Lockout Time
.
This
is
the
number
of
minutes
that
a
user
is
locked
out
upon
reaching
the
maximum
number
of
failed
attempts
(0
‐
60
minutes;
default
0).
0
means
that
the
lockout
is
in
effect
until
it
is
manually
unlocked.
2.
Enter
the
Failed Attempts
count.
This
is
the
number
of
failed
login
attempts
that
are
allowed
before
the
account
is
locked
out
(1
‐
10;
default
0).
By
default,
the
failed
attempt
count
is
0
and
the
user
is
not
locked
out
despite
repeated
failure
to
authenticate.
Step
3
Save
the
configuration
changes.
Click
Commit
,
and
select
Panorama
in
the
Commit Type
option.
