Integrate with a Palo Alto firewall

In this topic, you will learn how to set up Portnox™ Cloud to send user-to-IP mappings to a Palo Alto Networks firewall.

This integration lets the Palo Alto firewall apply policies and log activity by user identity instead of IP address. Portnox Cloud sends the mappings through the firewall identity mapper Docker container, which uses the Palo Alto User-ID XML API.

Configure the Palo Alto firewall

In this section, you will create an administrator account on the Palo Alto firewall and generate an API key for it.

Create an admin role for the integration.
1. In the Palo Alto web console, go to Device > Admin Roles and click on the Add button.
2. Enter a name for the role.
  
  In this example, we used the name Portnox Integration, but you can use any name you like.
3. Turn off all permissions in every tab.
4. In the XML API tab, turn on the User-ID Agent permission. Then, save the role.
Create an administrator account that uses this role.
1. Go to Device > Administrators and click on the Add button.
2. Enter a username and a password for the account.
  
  In this example, we used the username Portnox, but you can use any name you like.
3. In the Administrator Type field, select the Role Based option. Then, select the role that you created and click on the OK button.
4. Commit the changes.
Generate an API key for the account by opening the following URL in a browser:

https://firewall_IP/api/?type=keygen&user=username&password=password
Copy the value of the key element from the response to a temporary text file. You will need it later to configure Portnox Cloud.

Add and deploy a Docker container

In this section, you will add a firewall identity mapper container in Portnox Cloud and run it on your Docker host.

Note:

You need to deploy the Docker container on the same network as the Palo Alto firewall, so that it can send user-to-IP mappings to the firewall. The Docker host can be a Linux, Windows, or macOS machine or virtual machine. It needs outbound HTTPS access on port 443 to Portnox Cloud and to the management interface of the firewall. For more information about the Docker container, its requirements and configuration, see the following topic: The firewall identity mapper Docker container (fw-id-mapper).

In the Cloud portal top menu, click on the Settings option.
In the Cloud portal left-hand side menu, click on the Integration Services > FIREWALL INTEGRATION SERVICE option.
In the Firewall integration service section, click on the Add Docker container button.
In the Add Docker container window:
1. In the Container name field, enter a name for the container.
  
  In this example, we used the name Palo Alto, but you can use any name you like.
2. Click on the Copy command link. Then, paste the command into a temporary text file.
  
  Warning:
  If you click on the Generate a new token button, the current token stops working. Any container that uses it stops working until you redeploy it with the new command.
3. Click on the Add container button.
On the Docker host, paste the command that you copied into a terminal window and run it.

Note:
The command is optimized for a Linux/macOS Bash shell, not the Windows PowerShell shell used by Docker Desktop. If you use Docker Desktop on Windows, remove the trailing backslashes from each line and combine the Docker command into a single line.

Result: The container appears in the User-ID mapping section.

Add the firewall connection

In this section, you will connect the container to your Palo Alto firewall.

In the User-ID mapping section, find your container and click on the Add firewall connection button.
Enter the connection details:
1. In the Connection name field, enter a name for the firewall.
2. In the Vendor field, select the Palo Alto option.
3. In the Integration type field, select the User ID option.
4. In the IP address/hostname field, enter the IP address, hostname, or FQDN of the firewall’s management interface.
5. In the Port field, enter the port of the firewall’s web interface.
  
  The default value is 443.
6. Optional: In the Vsys field, enter the virtual system ID.
  
  Fill in this field only if the firewall runs multiple virtual systems. If you leave it empty, Portnox Cloud uses vsys1.
7. In the Keygen API key (/api/?type=keygen) field, paste the API key that you generated on the firewall and saved in a temporary text file.
8. Optional: In the Automatically unregister IP address-to-tag mapping (minutes) field, set the time after which the firewall removes a mapping that receives no updates.
  
  The default value is 60.
9. Optional: Click on the Test connection button to test the connection to the firewall.
10. Click on the Save connection button.

Result: Portnox Cloud sends user-to-IP mappings to the Palo Alto firewall when users authenticate.

Note:

One container can serve multiple firewalls as long as they’re accessible. To add another firewall, repeat the steps in this section.