Integrate the Palo Alto Networks firewall web interface with Zero Trust Network Access

In this topic, you will find general instructions on how to integrate the web interface of a Palo Alto Networks firewall with Portnox™ Zero Trust Network Access.

Modify your identity provider configuration to support the Palo Alto Networks firewall

The firewall identifies administrators by a username without a domain, for example, kosh instead of kosh@vorlon.com. Your identity provider must send this username in a custom claim.

Other applications that use the same identity provider configuration also receive the username claim. This causes no technical issues.

If you use an Entra ID IdP configuration, in another browser tab, open the Entra ID SAML application that you created earlier and do the following steps.
1. Open the Attributes & Claims pane (Enterprise apps > your Zero Trust Network Access application > Single sign-on > Attributes & Claims > Edit) and click on the Add new claim button.
2. In the Name field, type username. Then, in the Source section, select the Transformation option.
3. In the Manage transformation pane, in the Transformation field, select the ExtractMailPrefix() option. In the Parameter 1 section, select the Attribute option and the user.mail attribute. Then, click on the Add button.
  
  This transformation takes the part of the email address before the @ sign.
  
  Note:
  You can use user.userprincipalname instead of user.mail. In most cases, both hold the same value. For some accounts, such as guest accounts or service accounts, the user principal name can differ from the mail attribute or not be a real email address. Check your directory before you choose. Use user.mail as your default choice. Use user.userprincipalname if some admin accounts have no value in the mail attribute.
4. Click on the Save button.
If you use Google Workspace, open your admin console and do the following steps.

Note:
Unlike Entra ID, Google Workspace can’t derive the username from the email address. You must enter the username for every user that needs access to the firewall.
1. In Google Admin Console, go to Directory > Users. Then, click on the More options button, and select the Manage custom attributes option.
2. Click on the ADD CUSTOM ATTRIBUTE link.
3. In the Add custom fields pane, in the Category field, enter a category name and add one attribute: username. Set Info type to Text, Visibility to Visible to user and admin, and No. of values to Single Value. Then, click on the ADD button.
  
  In this example, we used the category name Palo Alto, but you can use any name you like.
4. Go back to the list of users. Then, open a user that needs access to the firewall, click on the ADD ALTERNATE EMAILS option, and scroll down to the Palo Alto category. Then, click on the ✎ icon and enter the username.
5. Repeat the above step for every user that requires access to the firewall.
6. Open the SAML attribute mapping pane (Apps > Web and mobile apps > your Zero Trust Network Access application > Configure SAML attribute mapping).
7. Click on the ADD MAPPING button and map Palo Alto > username to username. Then, click on the Save button.
  
  Note:
  You may have additional mappings in this configuration. They don’t affect the integration with the firewall.

Create a Portnox Cloud application configuration

In this step, you will create a configuration in Portnox Cloud that will contain all the information necessary to integrate with the firewall.

In a new tab of your browser, open your Portnox Cloud account by accessing the following URL: https://cloud.portnox.com/
From now on, we will call this tab the Portnox tab.
In the Cloud portal top menu, click on the Zero Trust Resources option.
On the Resources screen, click on the Create resource button.
1. In the What type of resource is this? section, select the SSO web application option.
2. In the Authentication protocol section, select the SAML option.
3. In the Application logo section, select one of the logos from the list, or select the Upload a custom logo option and then click on the Upload image button to upload a logo for the application.
  
  The logo is used in the Secure Access Portal.
4. Click on the Next button.
Optional: If you have more than one SAML identity provider configured, select the identity provider in the Select an identity provider to use for this resource section.
In the Resource details section, enter a Resource name and optionally a Description.

In this example, we used the name Palo Alto for the new application configuration but you can use any name you like.
Keep this browser tab open. You will need it later.

Access the Palo Alto SAML settings

In this section, you will locate the page in the firewall web interface where you can configure SAML identity providers.

In another tab of your browser, open your firewall web interface by accessing the following URL: https://firewall_address/, and log in as an administrator.
From now on, we will call this tab the Palo Alto tab.
In the top menu, select the Device option. Then, in the left-hand side menu, select the Server Profiles > SAML Identity Provider option.

Enter configuration values in the Portnox tab

In this section, you will enter the firewall SAML values in the relevant fields in Portnox Cloud.

In the Portnox tab, in the Resource properties section, click on the empty field under the Entity ID / Service Provider Entity URL heading and type the value: https://firewall_address:443/SAML20/SP, where firewall_address is the IP address or FQDN that you use to open the firewall web interface.

Note:
The firewall builds its SAML values from this address. It can be an IP address or a fully qualified domain name (FQDN). Users must always open the web interface with this exact address. If they use a different address, for example, the IP address instead of the FQDN, the login fails.
In the Portnox tab, in the Resource properties section, click on the empty field under the Assertion Consumer Service (ACS) URL / Reply URL heading and type the value: https://firewall_address:443/SAML20/SP/ACS, where firewall_address is the same address as in the previous step.

Copy configuration values from the Portnox tab to the Palo Alto tab

In this section, you will download the metadata file from Portnox Cloud and import it in the firewall to create a SAML identity provider server profile.

In the Portnox tab, in the SAML metadata section, click on the Download metadata XML file link to download the XML file and save it to your local drive.
In the Palo Alto tab, click on the Import button at the bottom of the screen.
In the import window, do the following steps.
1. In the Profile Name field, enter a name for the profile.
  
  In this example, we used the name Portnox ZTNA, but you can use any name you like.
2. Click on the Browse button next to the Identity Provider Metadata field and select the metadata file that you downloaded from Portnox Cloud.
  
  Note:
  The Identity Provider Metadata field shows the file path as C:\fakepath\. Browsers hide the real path for security reasons. The import works normally.
3. Deactivate the Validate Identity Provider Certificate checkbox.
  
  Note:
  Portnox Cloud signs SAML assertions with a self-signed certificate that isn’t marked as a CA certificate. This checkbox makes the firewall check the Portnox certificate against a CA, for example, for revocation or a trusted issuer. A self-signed certificate has no CA to check against, so the check always fails. These checks don’t apply to Portnox Cloud, because it manages its signing certificates itself. Deactivating the checkbox doesn’t reduce the security of the integration. The firewall still verifies every assertion signature with the Portnox certificate from the metadata file.
4. Make sure that the Sign SAML Message to IDP checkbox is deactivated.
  
  Note:
  Portnox Cloud doesn’t require signed authentication requests by default. If the Sign SAML Message to IDP checkbox is activated, the firewall requires a signing certificate in the authentication profile. You can require signed requests for extra security, but this takes extra steps that this guide doesn’t cover: create a certificate in the firewall, export it, and add it in Portnox Cloud.
5. Click on the OK button.

Create an authentication profile

In this section, you will create an authentication profile in the firewall that uses the SAML identity provider server profile.

In the Palo Alto tab, in the left-hand side menu, select the Authentication Profile option.
Click on the Add button at the bottom of the screen.
In the Authentication Profile window, do the following steps.
1. In the Name field, enter a name for the profile.
  
  In this example, we used the name Portnox ZTNA, but you can use any name you like.
2. In the Authentication tab, in the Type field, select the SAML option.
3. In the IdP Server Profile field, select the profile that you created in the previous section.
4. Make sure that the Certificate for Signing Requests field is set to None.
  
  Note:
  If you activated the Sign SAML Message to IDP checkbox in the previous section, select the signing certificate that you created in the firewall instead.
5. In the User Attributes in SAML Messages from IDP section, in the Username Attribute field, leave the default value username.
Click on the Advanced tab. In the Allow List section, click on the Add button and select all.

Note:
If the allow list is empty, the firewall rejects every SAML login.
Click on the OK button.

Create firewall administrators for your users

In this section, you will create an administrator account in the firewall for each user that needs access to the web interface.

In the Palo Alto tab, in the left-hand side menu, select the Administrators option.
Click on the Add button at the bottom of the screen.
In the Administrator window, do the following steps.
1. In the Name field, enter the username exactly as your identity provider sends it in the username claim.
  
  For example, for the user kosh@vorlon.com, enter kosh.
2. In the Authentication Profile field, select the authentication profile that you created in the previous section.
3. In the Administrator Type section, select a role that is appropriate for this user.
4. Click on the OK button.
Repeat the above two steps for every user that requires access to the firewall.

Note:
We recommend that you deactivate the default admin account or switch it to SAML authentication. Attackers try admin first in password-guessing attacks. Instead, keep one break-glass account: a local administrator account with a password, which does not use SAML, and is only used in emergencies. Give this account a random or hard-to-guess username and a strong password. If your SAML configuration ever stops working, you can still use this account to log in and fix the problem.

Finalize the configuration

In this section, you will finalize the configuration in Portnox Cloud and the firewall.

Finalize the configuration in the Portnox tab.
1. Optional: If users open the firewall web interface with a fully qualified domain name (FQDN) instead of an IP address, click on the OPTIONAL SETTINGS link to show additional fields, and then in the Application Login URI field, enter the following value: https://firewall_fqdn/, where firewall_fqdn is the FQDN that you used in the Entity ID / Service Provider Entity URL field.
  
  Note:
  This step is required if you want to show this application in the ZTNA Secure Access Portal.
  
  Note:
  This field doesn’t accept IP addresses. If users open the firewall web interface with an IP address, you can’t show the firewall in the ZTNA Secure Access Portal.
2. Optional: Click on the Next button, and in the Policy enforcement section, in the Device risk assessment section, change the setting to Override with custom policy and then select a risk assessment policy if you want to assess risk with this application using a custom risk assessment policy, and in the Access control section, change the setting to Override with custom policy and then select an access control policy if you want to control access to this application using a custom access control policy.
  
  Note:
  To configure the access control policy, follow the steps in this topic: Create or edit an access control policy. To select the default access control policy, on the Groups screen, select a group that you want to configure the default for, click on the ⋮ icon at the end of the row that represents the group, and then select the Group policies option. Then, in the ZTNA Resources section, select the policy in the SSO Web resources drop-down menu.
3. Scroll all the way down to the end of the page, and then click on the Add resource button.
Finalize the configuration in the Palo Alto tab.
1. Click on the Commit button in the top-right corner of the screen.
2. In the Commit window, click on the Commit button.
3. In the Commit Status window, wait until the Result field shows Successful. Then, click on the Close button.

Result: You have configured the Palo Alto Networks firewall web interface to be accessible using Portnox Zero Trust Network Access.