Book Image

Securing Remote Access in Palo Alto Networks

By : Tom Piens aka Piens aka 'reaper'
Book Image

Securing Remote Access in Palo Alto Networks

By: Tom Piens aka Piens aka 'reaper'

Overview of this book

This book builds on the content found in Mastering Palo Alto Networks, focusing on the different methods of establishing remote connectivity, automating log actions, and protecting against phishing attacks through user credential detection. Complete with step-by-step instructions, practical examples, and troubleshooting tips, you will gain a solid understanding of how to configure and deploy Palo Alto Networks remote access products. As you advance, you will learn how to design, deploy, and troubleshoot large-scale end-to-end user VPNs. Later, you will explore new features and discover how to incorporate them into your environment. By the end of this Palo Alto Networks book, you will have mastered the skills needed to design and configure SASE-compliant remote connectivity and prevent credential theft with credential detection.
Table of Contents (11 chapters)
1
Section 1: Leveraging the Cloud and Enabling Remote Access
6
Section 2: Tools, Troubleshooting, and Best Practices

Using IP user mapping for credential detection

When IP user mapping is set up correctly, we can enable Use IP User Mapping in the User Credential Detection section of URL filtering. Open URL Filtering Profile in Objects > Security Profiles > URL Filtering and access the User Credential Detection tab. Set User Credential Detection to Use IP User Mapping and select the severity logs should have for detected credentials in the Valid Username Detected Log Severity field as illustrated next:

Figure 6.14 – Use IP user mapping in user credential detection

In the Categories tab, the action URL filtering will apply when user credentials are detected and can be set for each category individually. This way, corporate credentials can be blocked for undesirable categories, as shown in Figure 6.15. A continue action can be used for categories where users are technically allowed to use corporate credentials but encouraged to think twice before doing so. Alternatively...