How to configure TACACS authentication against Cisco ISE

On Palo Alto Networks Firewall

1.  We will start with configuring the TACACS+ server profile on the Firewall under Device --> Server Profiles --> TACACS+. Please press the "Add" button in order to add the Cisco ISE details as below:
   
   
    
   • You can chose either PAP or CHAP for the authentication protocol, make sure that ISE authentication profile supports the one chosen in the above configuration.
   • Enter the Server details (ip, secret and port) and then click "Ok".
    
2.  Create an authentication Profile specifying the method as TACACS+ also the TACACS+ server profile which was created earlier in step#1 under Device --> Setup --> Authentication Profile and then click "OK" once done.
    
   
    
3. Create two admin roles under Device  -- > Admin Roles, one for Read-Only and the other for Read-Write as below:
   
   
   
   Read-Write Role
   
   
   Read-Only Role
   • You can specify exactly what the user can control or see on Web UI, via XML/Rest API and command line.
   • For Read-Write role everything is enabled and "superuser" role for CLI was added, while for the Read-Only role we disabled some functionalities and added the "superreader" role for the CLI.
    
4.  Configure the Authentication Settings to use the authentication profile configured earlier under Device --> Management --> Authentication Settings and press the "Gear" to the top right of the box:
   
   
   
    

On Cisco ISE:

1.  Create users under Work Centers --> Device Administration --> Identities as below:
   
   
    
   • Add the name, password and any other attribute needed as per the requirements, then click "Save".
   • In the above snapshot we created a user named "superadmin" which will have the Read-Write role, another user is also created with the name "Read-only" for Read-Only role.
2.  Create Device Groups in order to differentiate the request/response for the Firewall and the Panorama under Work Centers --> Device Administration --> Network Device Groups as below:
   
   
   
   
   
   
    
   • Created a group type named "Palo Alto Networks" with two groups "Firewall" and "Panorama"
      
3.  Create the Network Devices (Authenticators) which in our case are the Palo Alto Networks Firewall/Panorama from Work Centers --> Device Administration --> Network Resources as below:
   
   
    
   • In this step, we configure the Firewall parameters in ISE in order to make it aware of the source of the request, if the device was not configured then the ISE would drop the request, also you can see that we included the pre-configured group as Firewall in order to use it later for matching purposes, also we enabled TACACS and added the shared secret, make sure to use the same shared secret configured on the firewall.
4.  In this step we will configure the conditions which the ISE will use in order to match the request for its Authorization rule and then provide it the correct Shell profile (authorization profile), to configure it, go to Work Centers --> Device Administration --> Policy elements --> Authorization Simple Conditions , if the requirement to have compound condition then you can use it instead.
   • We will create two authorization conditions matching the username within the TACACS req check the below snapshot:
   
   
   Read-write User
   
   
                                                                     Read-Only User
    
5.    Now we need to create authorization result, which once we meet the above condition the Cisco ISE would provide parameters within the result (authorization profile) in order to let the Firewall/Panorama match the user  with the correct role as per the configuration done earlier, you can go to Work Centers --> Device Administration --> Policy Elements --> Result --> TACACS Profiles as below:
   
   
   Authorization Profile Read-only
    
   •  We have specified the vendor specific attribute for the Admin role and assigned it a value which is actually the role configured in the Firewall/Panorama, for more information about the VSAs please use the link below:
              https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/authentication/authentication-types/tacacs
    
   • The same authorization profile will be configured for the Read-Write role in order to be used later as a result for superadmin successful authorization.
    
   • In order to configure the allowed protocols which should be supported by ISE then you can go to Allowed Protocols from the same Tab as below:
   
   
    
6.  Now we will create the authentication and authorization rules (Policy Set) which the ISE will use to match the Tacacs Request attributes and provide the appropriate response based on them, you can go to Work Centers --> Device Administration --> Device Admin Policy Sets :
   
    
   
   
   
   Policy Set
    
   
   
   
   
   
   
   
   
   
   Authentication Policy
   
   
   
   
   Authorization Policy
    

Testing:

Read-Only Access to Firewall:

GUI:

•    Fewer number of tabs appeared once logged in as read-only user.

CLI:

 

Cisco ISE Logs:
 

 

•   The Response below provided the VSA's with a value equals to Read-only Access.

Read-Write Access to Firewall:

GUI:

 

         CLI:

• You can clearly see the difference now from CLI and GUI between Read-Only and Read-Write roles.

Cisco ISE logs:

Read-Only Access to Panorama:

GUI:

 

 

Troubleshooting:

• Enable debugs for authentication using the command debug authentication on debug from CLI, the result can be seen in the log file authd using the command less mp-log authd, an example can be seen as below:

For superadmin:

For Read-only:

• One more thing can be done which taking Tcpdump captures for the actual traffic generated , by default the firewall uses the management interface to communicate with the TACACS server, if it is changed to another interface then you can take packet captures from the monitor --> packet captures , else you have to create tcpdump captures on the CLI as per the below link:

Cisco ISE:

1.  Live logs:
   Operations --> Tacacs --> live logs
2. Reports:
   Operations --> Reports --> Device Administration --> Authorization / Authentication
3.  Packet Captures:
   Operations --> Troubleshoot --> Diagnostic Tools --> TCP Dump
4.  Debug Logs:
   Raise the log level to debug from Administration --> System --> Logging --> Debug Log Configuration, then choose the device which is processing the TACACS request and raise the log file runtime-AAA to debug.
   
   You can download the whole support bundle or only the log file from Operations --> Troubleshoot --> Download Logs , Choose either support bundle or Debug Logs.