®

Palo Alto Networks

Creating Granular Admin Role Profiles

for PAN-OS 5.0

Contact Information
Corporate Headquarters:
Palo Alto Networks
3300 Olcott Street
Santa Clara, CA 95054

http://www.paloaltonetworks.com/contact/contact/

Palo Alto Networks, Inc.

www.paloaltonetworks.com
© 2013 Palo Alto Networks. All rights reserved.
Palo Alto Networks, PAN-OS, and Panorama are trademarks of Palo Alto Networks,
Inc. All other trademarks are the property of their respective owners.

ii
 Creating Granular Admin Role Profiles
By default, every Palo Alto Networks firewall comes preconfigured with a default administrative account
(admin), which provides full read-write access (also known as superuser access) to the firewall. As a best practice,
you should create a separate administrative account for each person who needs access to the administrative or
reporting functions of the firewall. This allows you to better protect the firewall from unauthorized
configuration (or modification) and to enable logging of the actions of each individual firewall administrator.
Because it is common to delegate specific administrative tasks to specific administrators with varying roles,
Palo Alto Networks recommends that you create admin role profiles that allow administrators access only to
the areas of the management interface that are required to perform their jobs. You can then assign the various
roles you create to individual administrator accounts. By creating admin roles with very granular access privileges
you can ensure that sensitive company data is protected and end user privacy is ensured.
This document describes how to create an admin role profile and associate it with an administrative account. It
also provides detailed information on each privilege you can assign within the profile, with an emphasis on
protecting sensitive information. It includes the following sections:
 Create an Administrative Account with Role-Based Access

 Web Interface Access Privilege Details

 Define User Privacy Settings in the Admin Role Profile

Creating Granular Admin Role Profiles 1

Create an Administrative Account with Role-Based Access Creating Granular Admin Role Profiles

Create an Administrative Account with Role-Based Access

The following example shows how to create an admin role profile and assign it to a local administrator account:
CREATE A LOCAL ADMINISTRATOR

Step 1 Create the Admin Role Profiles you plan
to assign to your administrators. When
you create the profiles, you define what
type of access, if any, to give to the
different sections of the web interface,
CLI, and XML API for each
administrator assigned to the role. For
details on what a specific option enables,
see “Web Interface Access Privilege
Details” on page 3.
Complete the following steps for each role you want to create:
1. Select Device > Admin Roles and then click Add.
2. Enter a Name and optionally a Description for the role.
3. On the Web UI and/or XML API tabs, set the access levels—
Enable , Read Only , Disable —for each functional area
of the interface by clicking the icon to toggle it to the desired
setting.
4. On the Command Line tab, specify the type of access to allow
to the CLI: superreader, deviceadmin, or devicereader (for
Device roles); vsysadmin or vsysreader (for Virtual System
roles); or None to disable CLI access entirely.
5. Click OK to save the profile.

Step 2 (Optional) Set requirements for local
user-defined passwords.
• Create Password Profiles—Define how often administrators
must change their passwords. You can create multiple password
profiles and apply them to administrator accounts as needed to
enforce the desired security. To create a password profile, select
Device > Password Profiles and then click the Add.
• Configure minimum password complexity settings—Define
rules that govern password complexity, allowing you to force
administrators to create passwords that are harder to guess, crack,
or compromise. Unlike password profiles, which can be applied to
individual accounts, these rules are device wide and apply to all
passwords. To configure the settings, select Device > Setup and
then click the Edit icon in the Minimum Password Complexity
section.

Step 3 Create an account for each administrator 1. Select Device > Administrators and then click Add.
you want to allow access to and assign the 2. Enter a user Name and Password for the administrator.
role.
3. Select the Role to assign to this administrator. You can either
select one of the predefined Dynamic roles or a custom Role
Based profile if you created one in Step 1.
4. (Optional) Select a Password Profile.
5. Click OK to save the account.

Step 4 Commit your changes. 1. Click Commit.

2 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Web Interface Access Privilege Details

If you want to prevent a role-based administrator from accessing specific tabs on the web interface, you can
disable the tab and the administrator will not even see it when logging in using the associated role-based
administrative account. For example, you could create an Admin Role Profile for your operations staff that
provides access to the Device and Network tabs only and a separate profile for your security administrators that
provides access to the Object, Policy, and Monitor tabs.
The following table describes the tab-level access privileges you can assign to the admin role profile. It also
provides cross-references to additional tables that detail granular privileges within a tab. For specific information
on how to set the admin role profile to protect end user privacy, see “Define User Privacy Settings in the Admin
Role Profile” on page 26.
Table 1-1 Tab-Level Access Privileges

Access Level Description Enable Read Only Disable

Dashboard Controls access to the Dashboard tab. If you Yes No Yes

disable this privilege, the administrator will not see
the tab and will not have access to any of the
Dashboard widgets.

ACC Controls access to the Application Command Yes No Yes

Center (ACC). If you disable this privilege, the
ACC tab will not display in the web interface. Keep
in mind that if you want to protect the privacy of
your users while still providing access to the ACC,
you can disable the Privacy > Show Full Ip
Addresses option and/or the Show User Names
In Logs And Reports option.

Monitor Controls access to the Monitor tab. If you disable Yes No Yes
this privilege, the administrator will not see the
Monitor tab and will not have access to any of the
logs, packet captures, session information, reports
or to App Scope. For more granular control over
what monitoring information the admin can see,
leave the Monitor option enabled and then enable
or disable specific nodes on the tab as described in
“Provide Granular Access to the Monitor Tab” on
page 5.

Policies Controls access to the Policies tab. If you disable Yes No Yes
this privilege, the administrator will not see the
Policies tab and will not have access to any policy
information. For more granular control over what
policy information the admin can see, for example
to enable access to a specific type of policy or to
enable read-only access to policy information,
leave the Policies option enabled and then enable
or disable specific nodes on the tab as described in
“Provide Granular Access to the Policy Tab” on
page 10.

Creating Granular Admin Role Profiles 3

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-1 Tab-Level Access Privileges (Continued)

Access Level Description Enable Read Only Disable

Objects Controls access to the Objects tab. If you disable Yes No Yes
this privilege, the administrator will not see the
Objects tab and will not have access to any
objects, security profiles, log forwarding profiles,
decryption profiles, or schedules. For more
granular control over what objects the admin can
see, leave the Objects option enabled and then
enable or disable specific nodes on the tab as
described in “Provide Granular Access to the
Objects Tab” on page 12.

Network Controls access to the Network tab. If you disable Yes No Yes
this privilege, the administrator will not see the
Network tab and will not have access to any
interface, zone, VLAN, virtual wire, virtual router,
IPSec tunnel, DHCP, DNS Proxy, GlobalProtect,
or QoS configuration information or to the
network profiles. For more granular control over
what objects the admin can see, leave the Network
option enabled and then enable or disable specific
nodes on the tab as described in “Provide
Granular Access to the Network Tab” on page 15.

Device Controls access to the Device tab. If you disable Yes No Yes
this privilege, the administrator will not see the
Device tab and will not have access to any
device-wide configuration information, such as
User-ID, High Availability, server profile or
certificate configuration information. For more
granular control over what objects the admin can
see, leave the Objects option enabled and then
enable or disable specific nodes on the tab as
described in “Provide Granular Access to the
Device Tab” on page 18.
Note You cannot enable access to the Admin
Roles or Administrators nodes for a
role-based administrator even if you
enable full access to the Device tab.

4 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Provide Granular Access to the Monitor Tab

In some cases you might want to enable the administrator to view some but not all areas of the Monitor tab.
For example, you may want to restrict operations admins to the configuration and system logs only, because they
do not contain sensitive user data. Although this section of the admin role definition specifies what areas of the
Monitor tab the admin can see, you can also couple privileges in this section with privacy privileges, such as
disabling the ability to see user names in logs and reports. One thing to keep in mind, however, is that any system
generated reports will still show user names and IP addresses even if you disable that functionality in the role.
For this reason, if you do not want the admin to see any of the private user information, you should disable
access to the specific reports as detailed in the following table.
Table 1-2 Restricting user access to functions within the Monitor tab

Access Level Description Enable Read Only Disable

Monitor Enables or disables access to the Monitor tab. If Yes No Yes

disabled, the admin will not see this tab or any of
the associated logs or reports.

Logs Enables or disables access to all log files. You can Yes No Yes
also leave this privilege enabled and then disable
specific logs that you do not want the admin to
see. Keep in mind that if you want to protect the
privacy of your users while still providing access to
one or more of the logs, you can disable the
Privacy > Show Full Ip Addresses option and/or
the Show User Names In Logs And Reports
option.

Traffic Specifies whether the admin can see the traffic Yes No Yes
logs.

Threat Specifies whether the admin can see the threat Yes No Yes
logs.

URL Filtering Specifies whether the admin can see the URL Yes No Yes
filtering logs.

WildFire Specifies whether the admin can see the WildFire Yes No Yes
logs. These logs are only available if you have a
WildFire license.

Data Filtering Specifies whether the admin can see the data Yes No Yes
filtering logs.

HIP Match Specifies whether the admin can see the HIP Yes No Yes
Match logs. HIP Match logs are only available if
you have a GlobalProtect portal license and
gateway subscription.

Configuration Specifies whether the admin can see the Yes No Yes
configuration logs.

Creating Granular Admin Role Profiles 5

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-2 Restricting user access to functions within the Monitor tab (Continued)

Access Level Description Enable Read Only Disable

System Specifies whether the admin can see the system Yes No Yes
logs.

Alarms Specifies whether the admin can see system Yes No Yes
generated alarms.

Packet Capture Specifies whether the admin can see packet Yes Yes Yes
captures (pcaps) from the Monitor tab. Keep in
mind that packet captures are raw flow data and as
such may contain user IP addresses. Disabling the
Show Full IP Addresses privileges will not
obfuscate the IP address in the pcap and you
should therefore disable the Packet Capture
privilege if you are concerned about user privacy.

App Scope Specifies whether the admin can see the App Yes No Yes
Scope visibility and analysis tools. Enabling App
Scope enables access to all of the App Scope
charts.

Session Browser Specifies whether the admin can browse and filter Yes No Yes
current running sessions on the firewall. Keep in
mind that the session browser shows raw flow
data and as such may contain user IP addresses.
Disabling the Show Full IP Addresses privileges
will not obfuscate the IP address in the session
browser and you should therefore disable the
Session Browser privilege if you are concerned
about user privacy.

Botnet Specifies whether the admin can generate and Yes Yes Yes
view botnet analysis reports or view botnet
reports in read-only mode. Disabling the Show
Full IP Addresses privileges will not obfuscate
the IP address in scheduled botnet reports and
you should therefore disable the Botnet privilege
if you are concerned about user privacy.

PDF Reports Enables or disables access to all PDF reports. You Yes No Yes
can also leave this privilege enabled and then
disable specific PDF reports that you do not want
the admin to see. Keep in mind that if you want to
protect the privacy of your users while still
providing access to one or more of the reports,
you can disable the Privacy > Show Full Ip
Addresses option and/or the Show User Names
In Logs And Reports option.

6 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-2 Restricting user access to functions within the Monitor tab (Continued)

Access Level Description Enable Read Only Disable

Manage PDF Summary Specifies whether the admin can view, add or Yes Yes Yes
delete PDF summary report definitions. With
read-only access, the admin can see PDF summary
report definitions, but not add or delete them. If
you disable this option, the admin can neither view
the report definitions or add/delete them.

PDF Summary Reports Specifies whether the admin can see the generated Yes No Yes
PDF Summary reports in Monitor > Reports. If
you disable this option, the PDF Summary
Reports category will not display in the Reports
node.

User Activity Report Specifies whether the admin can view, add or Yes Yes Yes
delete User Activity report definitions and
download the reports. With read-only access, the
admin can see User Activity report definitions, but
not add, delete, or download them. If you disable
this option, the admin cannot see this category of
PDF report.

Report Groups Specifies whether the admin can view, add or Yes Yes Yes
delete report group definitions. With read-only
access, the admin can see report group definitions,
but not add or delete them. If you disable this
option, the admin cannot see this category of PDF
report.

Email Scheduler Specifies whether the admin can schedule report Yes Yes Yes
groups for email. Because the generated reports
that get emailed may contain sensitive user data
that is not removed by disabling the Privacy >
Show Full Ip Addresses option and/or the Show
User Names In Logs And Reports options and
because they may also show log data to which the
admin does not have access, you should disable
the Email Scheduler option if you have user
privacy requirements.

Creating Granular Admin Role Profiles 7

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-2 Restricting user access to functions within the Monitor tab (Continued)

Access Level Description Enable Read Only Disable

Manage Custom Enables or disables access to all Custom report Yes No Yes
Reports functionality. You can also leave this privilege
enabled and then disable specific custom report
categories that you do not want the admin to be
able to access. Keep in mind that if you want to
protect the privacy of your users while still
providing access to one or more of the reports,
you can disable the Privacy > Show Full Ip
Addresses option and/or the Show User Names
In Logs And Reports option. Note, however, that
reports that are scheduled to run rather than run
on demand will show IP address and user
information. In this case, be sure to restrict access
to the corresponding report areas. In addition, the
custom report feature does not restrict the ability
to generate reports that contain log data contained
in logs that are excluded from the admin role.

Application Statistics Specifies whether the admin can create a custom Yes No Yes
report that includes data from the application
statistics database.

Data Filtering Log Specifies whether the admin can create a custom Yes No Yes
report that includes data from the data filtering
log.

Threat Log Specifies whether the admin can create a custom Yes No Yes
report that includes data from the threat log.

Threat Summary Specifies whether the admin can create a custom Yes No Yes
report that includes data from the threat summary
database.

Traffic Log Specifies whether the admin can create a custom Yes No Yes
report that includes data from the traffic log.

Traffic Summary Specifies whether the admin can create a custom Yes No Yes
report that includes data from the traffic summary
database.

Url Log Specifies whether the admin can create a custom Yes No Yes
report that includes data from the URL filtering
log.

Hipmatch Specifies whether the admin can create a custom Yes No Yes
report that includes data from the HIP match log.

8 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-2 Restricting user access to functions within the Monitor tab (Continued)

Access Level Description Enable Read Only Disable

Application Reports Specifies whether the admin can view Application Yes No Yes
Reports. Privacy privileges do not impact reports
available on the Monitor > Reports node and you
should therefore disable access to the reports if
you have user privacy requirements.

Threat Reports Specifies whether the admin can view Threat Yes No Yes
Reports. Privacy privileges do not impact reports
available on the Monitor > Reports node and you
should therefore disable access to the reports if
you have user privacy requirements.

URL Filtering Reports Specifies whether the admin can view URL Yes No Yes
Filtering Reports. Privacy privileges do not impact
reports available on the Monitor > Reports node
and you should therefore disable access to the
reports if you have user privacy requirements.

Traffic Reports Specifies whether the admin can view Traffic Yes No Yes
Reports. Privacy privileges do not impact reports
available on the Monitor > Reports node and you
should therefore disable access to the reports if
you have user privacy requirements.

Creating Granular Admin Role Profiles 9

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Provide Granular Access to the Policy Tab

If you enable the Policy option in the admin role profile, you can then enable, disable, or provide read-only
access to specific nodes within the tab as necessary for the admin role you are defining. By enabling access to a
specific policy type, you enable the ability to view, add, or delete policy rules. By enabling read-only access to a
specific policy, you enable the admin to view the corresponding policy rule base, but not add or delete rules.
Disabling access to a specific type of policy prevents the admin from seeing the policy rule base.
Because policy that is based on specific users (by user name or IP address) must be explicitly defined, privacy
settings that disable the ability to see full IP addresses or user names do not apply to the Policy tab. Therefore,
you should only allow access to the Policy tab to administrators that are excluded from user privacy restrictions.
Table 1-3 Restricting user access to functions with the Policy tab

Access Level Description Enable Read Only Disable

Security Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete security policy rules. Set the
privilege to read only if you want the admin to be
able to see the rules, but not modify them. To
prevent the admin from seeing the security policy
rule base, disable this privilege.

NAT Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete NAT policy rules. Set the
privilege to read only if you want the admin to be
able to see the rules, but not modify them. To
prevent the admin from seeing the NAT policy
rule base, disable this privilege.

QoS Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete QoS policy rules. Set the
privilege to read only if you want the admin to be
able to see the rules, but not modify them. To
prevent the admin from seeing the QoS policy rule
base, disable this privilege.

Policy Based Enable this privilege to allow the admin to view, Yes Yes Yes
Forwarding add, and/or delete Policy Based Forwarding (PBF)
policy rules. Set the privilege to read only if you
want the admin to be able to see the rules, but not
modify them. To prevent the admin from seeing
the PBF policy rule base, disable this privilege.

Decryption Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete decryption policy rules. Set the
privilege to read only if you want the admin to be
able to see the rules, but not modify them. To
prevent the admin from seeing the decryption
policy rule base, disable this privilege.

10 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-3 Restricting user access to functions with the Policy tab (Continued)

Access Level Description Enable Read Only Disable

Application Override Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete application override policy
rules. Set the privilege to read only if you want the
admin to be able to see the rules, but not modify
them. To prevent the admin from seeing the
application override policy rule base, disable this
privilege.

Captive Portal Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete captive portal policy rules. Set
the privilege to read only if you want the admin to
be able to see the rules, but not modify them. To
prevent the admin from seeing the captive portal
policy rule base, disable this privilege.

DoS Protection Enable this privilege to allow the admin to view, Yes Yes Yes
add, and/or delete DoS protection policy rules.
Set the privilege to read only if you want the admin
to be able to see the rules, but not modify them.
To prevent the admin from seeing the DoS
protection policy rule base, disable this privilege.

Creating Granular Admin Role Profiles 11

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Provide Granular Access to the Objects Tab

An object is a container that groups specific policy filter values—such as IP addresses, URLs, applications, or
services—for simplified rule definition. For example, an address object might contain specific IP address
definitions for the web and application servers in your DMZ zone.
When deciding whether to allow access to the objects tab as a whole, determine whether the admin will have
policy definition responsibilities. If not, the admin probably does not need access to the tab. If, however, the
admin will need to create policy, you can enable access to the tab and then provide granular access privileges at
the node level.
By enabling access to a specific node, you give the admin the privilege to view, add, and delete the corresponding
object type. Giving read-only access allows the admin to view the already defined objects, but not create or
delete any. Disabling a node prevents the admin from seeing the node in the web interface.

Table 1-4 Restricting user access to functions with the Object tab

Access Level Enable Read Only Disable

Addresses Specifies whether the admin can view, add, or Yes Yes Yes
delete address objects for use in security policy.

Address Groups Specifies whether the admin can view, add, or Yes Yes Yes
delete address group objects for use in security
policy.

Regions Specifies whether the admin can view, add, or Yes Yes Yes
delete regions objects for use in security,
decryption, or DoS policy.

Applications Specifies whether the admin can view, add, or Yes Yes Yes
delete application objects for use in policy.

Application Groups Specifies whether the admin can view, add, or Yes Yes Yes
delete application group objects for use in policy.

Application Filters Specifies whether the admin can view, add, or Yes Yes Yes
delete application filters for simplification of
repeated searches.

Services Specifies whether the admin can view, add, or Yes Yes Yes
delete service objects for use in creating policies
that limit the port numbers an application can use.

Service Groups Specifies whether the admin can view, add, or Yes Yes Yes
delete service group objects for use in security
policy.

GlobalProtect Specifies whether the admin can view, add, or Yes No Yes
delete HIP objects and profiles. You can restrict
access to both types of objects at the
GlobalProtect level, or provide more granular
control by enabling the GlobalProtect privilege
and restricting HIP Object or HIP Profile access.

12 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-4 Restricting user access to functions with the Object tab (Continued)

Access Level Enable Read Only Disable

HIP Objects Specifies whether the admin can view, add, or Yes Yes Yes
delete HIP objects, which are used to define HIP
profiles. HIP Objects also generate HIP Match
logs.

HIP Profiles Specifies whether the admin can view, add, or Yes Yes Yes
delete HIP Profiles for use in security policy
and/or for generating HIP Match logs.

Custom URL Category Specifies whether the admin can view, add, or Yes Yes Yes
delete custom URL categories for use in policy.

Dynamic Block Lists Specifies whether the admin can view, add, or Yes Yes Yes
delete dynamic block lists for use in security policy.

Custom Signatures Specifies whether the admin can see the custom Yes No Yes
spyware and vulnerability signatures. You can
restrict access to either enable or disable access to
all custom signatures at this level, or provide more
granular control by enabling the Custom
Signatures privilege and then restricting access to
each type of signature.

Data Patterns Specifies whether the admin can view, add, or Yes Yes Yes
delete custom data pattern signatures for use in
creating custom vulnerability protection profiles.

Spyware Specifies whether the admin can view, add, or Yes Yes Yes
delete custom spyware signatures for use in
creating custom vulnerability protection profiles.

Vulnerability Specifies whether the admin can view, add, or Yes Yes Yes
Protection delete custom vulnerability signatures for use in
creating custom vulnerability protection profiles.

Security Profiles Specifies whether the admin can see security Yes No Yes
profiles. You can restrict access to either enable or
disable access to all security profiles at this level, or
provide more granular control by enabling the
Security Profiles privilege and then restricting
access to each type of profile.

Antivirus Specifies whether the admin can view, add, or Yes Yes Yes
delete antivirus profiles.

Anti-Spyware Specifies whether the admin can view, add, or Yes Yes Yes
delete anti-spyware profiles.

Vulnerability Specifies whether the admin can view, add, or Yes Yes Yes
Protection delete vulnerability protection profiles.

Creating Granular Admin Role Profiles 13

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-4 Restricting user access to functions with the Object tab (Continued)

Access Level Enable Read Only Disable

URL Filtering Specifies whether the admin can view, add, or Yes Yes Yes
delete URL filtering profiles.

File Blocking Specifies whether the admin can view, add, or Yes Yes Yes
delete file blocking profiles.

Data Filtering Specifies whether the admin can view, add, or Yes Yes Yes
delete data filtering profiles.

DoS Protection Specifies whether the admin can view, add, or Yes Yes Yes
delete DoS protection profiles.

Security Profile Groups Specifies whether the admin can view, add, or Yes Yes Yes
delete security profile groups.

Log Forwarding Specifies whether the admin can view, add, or Yes Yes Yes
delete log forwarding profiles.

Decryption Profile Specifies whether the admin can view, add, or Yes Yes Yes
delete decryption profiles.

Schedules Specifies whether the admin can view, add, or Yes Yes Yes
delete schedules for limiting a security policy to a
specific date and/or time range.

14 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Provide Granular Access to the Network Tab

When deciding whether to allow access to the Network tab as a whole, determine whether the admin will have
network administration responsibilities, including GlobalProtect administration. If not, the admin probably
does not need access to the tab.
You can also define access to the Network tab at the node level. By enabling access to a specific node, you give
the admin the privilege to view, add, and delete the corresponding network configurations. Giving read-only
access allows the admin to view the already defined configuration, but not create or delete any. Disabling a node
prevents the admin from seeing the node in the web interface.

Table 1-5 Restricting user access to functions with the Network tab

Access Level Enable Read Only Disable

Interfaces Specifies whether the admin can view, add, or Yes Yes Yes
delete interface configurations.

Zones Specifies whether the admin can view, add, or Yes Yes Yes
delete zones.

VLANs Specifies whether the admin can view, add, or Yes Yes Yes
delete VLANs.

Virtual Wires Specifies whether the admin can view, add, or Yes Yes Yes
delete virtual wires.

Virtual Routers Specifies whether the admin can view, add, modify Yes Yes Yes
or delete virtual routers.

IPSec Tunnels Specifies whether the admin can view, add, Yes Yes Yes
modify, or delete IPSec Tunnel configurations.

DHCP Specifies whether the admin can view, add, Yes Yes Yes
modify, or delete DHCP server and DHCP relay
configurations.

DNS Proxy Specifies whether the admin can view, add, Yes Yes Yes
modify, or delete DNS proxy configurations.

GlobalProtect Specifies whether the admin can view, add, modify Yes No Yes
GlobalProtect portal and gateway configurations.
You can disable access to the GlobalProtect
functions entirely, or you can enable the
GlobalProtect privilege and then restrict the role
to either the portal or gateway configuration areas.

Portals Specifies whether the admin can view, add, Yes Yes Yes
modify, or delete GlobalProtect portal
configurations.

Gateways Specifies whether the admin can view, add, Yes Yes Yes
modify, or delete GlobalProtect gateway
configurations.

Creating Granular Admin Role Profiles 15

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-5 Restricting user access to functions with the Network tab (Continued)

Access Level Enable Read Only Disable

QoS Yes Yes Yes

Network Profiles Sets the default state to enable or disable for all of Yes No Yes
the Network settings described below.

IKE Gateways Controls access to the Network Profiles > IKE Yes Yes Yes
Gateways node. If you disable this privilege, the
administrator will not see the IKE Gateways node
or define gateways that include the configuration
information necessary to perform IKE protocol
negotiation with peer gateway.
If the privilege state is set to read only, you can
view the currently configured IKE Gateways but
cannot add or edit gateways.

IPSec Crypto Controls access to the Network Profiles > IPSec Yes Yes Yes
Crypto node. If you disable this privilege, the
administrator will not see the Network Profiles >
IPSec Crypto node or specify protocols and
algorithms for identification, authentication, and
encryption in VPN tunnels based on IPSec SA
negotiation.
If the privilege state is set to read only, you can
view the currently configured IPSec Crypto
configuration but cannot add or edit a
configuration.

Monitor Controls access to the Network Profiles > Yes Yes Yes
Monitor node. If you disable this privilege, the
administrator will not see the Network Profiles >
Monitor node or be able to create or edit a
monitor profile that is used to monitor IPSec
tunnels and monitor a next-hop device for
policy-based forwarding (PBF) rules.
If the privilege state is set to read only, you can
view the currently configured monitor profile
configuration but cannot add or edit a
configuration.

16 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-5 Restricting user access to functions with the Network tab (Continued)

Access Level Enable Read Only Disable

Interface Mgmt Controls access to the Network Profiles > Yes Yes Yes
Interface Mgmt node. If you disable this privilege,
the administrator will not see the Network
Profiles > Interface Mgmt node or be able to
specify the protocols that are used to manage the
firewall.
If the privilege state is set to read only, you can
view the currently configured Interface
management profile configuration but cannot add
or edit a configuration.

Zone Controls access to the Network Profiles > Zone Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Network Profiles >
Zone node or be able to configure a profile that
determines how the firewall responds to attacks
from specified security zones.
If the privilege state is set to read only, you can
view the currently configured Zone profile
configuration but cannot add or edit a
configuration.

QoS Profile Controls access to the Network Profiles > QoS Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Network Profiles >
QoS node or be able to configure a profile QoS
profile that determines how QoS traffic classes are
treated.
If the privilege state is set to read only, you can
view the currently configured QoS profile
configuration but cannot add or edit a
configuration.

Creating Granular Admin Role Profiles 17

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Provide Granular Access to the Device Tab

Table 1-6 Restricting user access to functions with the Device tab

Access Level Enable Read Only Disable

Setup Controls access to the Setup node. If you disable Yes Yes Yes
this privilege, the administrator will not see the
Setup node or have access to device-wide setup
configuration information, such as Management,
Operations, Service, Content-ID, Wildfire or
Session setup information.
If the privilege state is set to read only, you can
view the current configuration but cannot make
any changes.

Config Audit Controls access to the Config Audit node. If you Yes No Yes
disable this privilege, the administrator will not see
the Config Audit node or have access to any
device-wide configuration information.

Admin Roles Controls access to the Admin Roles node. This No Yes Yes
function can only be allowed for read only access.
If you disable this privilege, the administrator will
not see the Admin Roles node or have access to
any device-wide information concerning admin
roles configuration.
If you set this privilege to read only, you can view
the configuration information for all admin roles
configured on the device.

Administrators Controls access to the Administrators node. This No Yes Yes

function can only be allowed for read only access.
If you disable this privilege, the administrator will
not see the Administrators node or have access to
information about their own admin account.
If you set this privilege to read only, the
administrator can view the configuration
information for their own admin account. They
will not see any information about other admin
accounts configured on the device.

18 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

User Identification Controls access to the User Identification node. If Yes Yes Yes
you disable this privilege, the administrator will
not see the User Identification node or have
access to device-wide User Identification
configuration information, such as User Mapping,
User-ID Agents, Service, Terminal Services
Agents, Group Mappings Settings or Captive
Portal Settings.
If you set this privilege to read only, the
administrator can view configuration information
for the device but is not allowed to perform any
configuration procedures.

High Availability Controls access to the High Availability node. If Yes Yes Yes
you disable this privilege, the administrator will
not see the High Availability node or have access
to device-wide high availability configuration
information such as General setup information or
Link and Path Monitoring.
If you set this privilege to read only, the
administrator can view High Availability
configuration information for the device but is
not allowed to perform any configuration
procedures.

Certificate Management Sets the default state to enable or disable for all of Yes No Yes
the Certificate settings described below.

Certificates Controls access to the Certificates node. If you Yes Yes Yes
disable this privilege, the administrator will not see
the Certificates node or be able to configure or
access information regarding Device Certificates
or Default Trusted Certificate Authorities.
If you set this privilege to read only, the
administrator can view Certificate configuration
information for the device but is not allowed to
perform any configuration procedures.

Certificate Profile Controls access to the Certificate Profile node. If Yes Yes Yes
you disable this privilege, the administrator will
not see the Certificate Profile node or be able to
create certificate profiles.
If you set this privilege to read only, the
administrator can view Certificate Profiles that are
currently configured for the device but is not
allowed to create or edit a certificate profile.

Creating Granular Admin Role Profiles 19

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

OCSP Responder Controls access to the OCSP Responder node. If Yes Yes Yes
you disable this privilege, the administrator will
not see the OCSP Responder node or be able to
define a server that will be used to verify the
revocation status of certificates issues by the
PAN-OS device.
If you set this privilege to read only, the
administrator can view the OCSP Responder
configuration for the device but is not allowed to
create or edit an OCSP responder configuration.

Response Pages Controls access to the Response Pages node. If Yes Yes Yes
you disable this privilege, the administrator will
not see the Response Page node or be able to
define a custom HTML message that is
downloaded and displayed instead of a requested
web page or file.
If you set this privilege to read only, the
administrator can view the Response Page
configuration for the device but is not allowed to
create or edit a response page configuration.

Log Settings Sets the default state to enable or disable for all of Yes No Yes
the Log settings described below.

System Controls access to the Log Settings > System Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Log Settings >
System node or be able to specify the severity
levels of the system log entries that are logged
remotely with Panorama and sent as SNMP traps,
syslog messages, and/or email notifications.
If you set this privilege to read only, the
administrator can view the Log Settings > System
configuration for the device but is not allowed to
create or edit a configuration.

Config Controls access to the Log Settings > Config Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Log Settings >
Config node or be able to specify the
configuration log entries that are logged remotely
with Panorama, and sent as syslog messages
and/or email notification.
If you set this privilege to read only, the
administrator can view the Log Settings > Config
configuration for the device but is not allowed to
create or edit a configuration.

20 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

HIP Match Controls access to the Log Settings > HIP Match Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Log Settings > HIP
Match node or be able to specify the Host
Information Profile (HIP) match log settings that
are used to provide information on security
policies that apply to GlobalProtect clients
If you set this privilege to read only, the
administrator can view the Log Settings > HIP
configuration for the device but is not allowed to
create or edit a configuration.

Alarms Controls access to the Log Settings > Alarms Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Log Settings >
Alarms node or be able to configure notifications
that are generated when a security rule (or group
of rules) has been hit repeatedly in a set period of
time.
If you set this privilege to read only, the
administrator can view the Log Settings > Alarms
configuration for the device but is not allowed to
create or edit a configuration.

Manage Logs Controls access to the Log Settings > Manage Yes Yes Yes
Logs node. If you disable this privilege, the
administrator will not see the Log Settings >
Manage Logs node or be able to clear the
indicated logs.
If you set this privilege to read only, the
administrator can view the Log Settings >
Manage Logs information but cannot clear any of
the logs.

Server Profiles Sets the default state to enable or disable for all of Yes No Yes
the Server Profiles settings described below.

SNMP Trap Controls access to the Server Profiles> SNMP Yes Yes Yes
Trap node. If you disable this privilege, the
administrator will not see the Server Profiles>
SNMP Trap node or be able to specify one or more
SNMP trap destinations to be used for system log
entries.
If you set this privilege to read only, the
administrator can view the Server Profiles>
SNMP Trap Logs information but cannot specify
SNMP trap destinations.

Creating Granular Admin Role Profiles 21

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

Syslog Controls access to the Server Profiles> Syslog Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Server Profiles>
Syslog node or be able to specify one or more
syslog servers.
If you set this privilege to read only, the
administrator can view the Server Profiles>
Syslog information but cannot specify syslog
servers.

Email Controls access to the Server Profiles> Email Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Server Profiles>
Email node or be able to configure an email
profile that can be used to enable email
notification for system and configuration log
entries
If you set this privilege to read only, the
administrator can view the Server Profiles>
Email information but cannot configure and email
profile.

Netflow Controls access to the Server Profiles> Netflow Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Server Profiles>
Netflow node or be able to define a NetFlow
server profile, which specifies the frequency of the
export along with the NetFlow servers that will
receive the exported data.
If you set this privilege to read only, the
administrator can view the Server Profiles>
Netflow information but cannot define a Netflow
profile.

RADIUS Controls access to the Server Profiles> RADIUS Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Server Profiles>
RADIUS node or be able to configure settings for
the RADIUS servers that are identified in
authentication profiles.
If you set this privilege to read only, the
administrator can view the Server Profiles>
RADIUS information but cannot configure
settings for the RADIUS servers.

22 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

LDAP Controls access to the Server Profiles> LDAP Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Server Profiles>
LDAP node or be able to configure settings for the
LDAP servers to use for authentication by way of
authentication profiles.
If you set this privilege to read only, the
administrator can view the Server Profiles>
LDAP information but cannot configure settings
for the LDAP servers.

Kerberos Controls access to the Server Profiles> Kerberos Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Server Profiles>
Kerberos node or configure a Kerberos server
that allows users to authenticate natively to a
domain controller.
If you set this privilege to read only, the
administrator can view the Server Profiles>
Kerberos information but cannot configure
settings for Kerberos servers.

Local User Database Sets the default state to enable or disable for all of Yes No Yes
the Local User Database settings described below.

Users Controls access to the Local User Database > Yes Yes Yes
Users node. If you disable this privilege, the
administrator will not see the Local User
Database > Users node or set up a local database
on the firewall to store authentication information
for remote access users, device administrators, and
captive portal users.
If you set this privilege to read only, the
administrator can view the Local User Database
> Users information but cannot set up a local
database on the firewall to store authentication
information.

User Groups Controls access to the Local User Database > Yes Yes Yes
Users node. If you disable this privilege, the
administrator will not see the Local User
Database > Users node or be able to add user
group information to the local database.
If you set this privilege to read only, the
administrator can view the Local User Database
> Users information but cannot add user group
information to the local database.

Creating Granular Admin Role Profiles 23

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

Authentication Profile Controls access to the Authentication Profile Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Authentication
Profile node or be able to create or edit
authentication profiles that specify local database,
RADIUS, LDAP, or Kerberos settings that can be
assigned to administrator accounts.
If you set this privilege to read only, the
administrator can view the Authentication
Profile information but cannot create or edit an
authentication profile.

Authentication Controls access to the Authentication Sequence Yes Yes Yes

Sequence node. If you disable this privilege, the
administrator will not see the Authentication
Sequence node or be able to create or edit an
authentication sequence.
If you set this privilege to read only, the
administrator can view the Authentication
Profile information but cannot create or edit an
authentication sequence.

Access Domain Controls access to the Authentication Sequence Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the Authentication
Sequence node or be able to create or edit an
authentication sequence.
If you set this privilege to read only, the
administrator can view the Authentication
Profile information but cannot create or edit an
authentication sequence.

Scheduled Log Export Controls access to the Scheduled Log Export Yes No Yes
node. If you disable this privilege, the
administrator will not see the Scheduled Log
Export node or be able schedule exports of logs
and save them to a File Transfer Protocol (FTP)
server in CSV format or use Secure Copy (SCP) to
securely transfer data between the device and a
remote host.
If you set this privilege to read only, the
administrator can view the Scheduled Log
Export Profile information but cannot schedule
the export of logs.

24 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

Software Controls access to the Software node. If you Yes Yes Yes
disable this privilege, the administrator will not see
the Software node or view the latest versions of
the PAN-OS software available from Palo Alto
Networks, read the release notes for each version,
and select a release to download and install.
If you set this privilege to read only, the
administrator can view the Software information
but cannot download or install software.

GlobalProtect Client Controls access to the GlobalProtect Client Yes Yes Yes
node. If you disable this privilege, the
administrator will not see the GlobalProtect
Client node or view available GlobalProtect
releases, download the code or activate the
GlobalProtect agent.
If you set this privilege to read only, the
administrator can view the available
GlobalProtect Client releases but cannot
download or install the agent software.

Dynamic Updates Controls access to the Dynamic Updates node. Yes Yes Yes
If you disable this privilege, the administrator will
not see the Dynamic Updates node or be able to
view the latest updates, read the release notes for
each update, or select an update to upload and
install.
If you set this privilege to read only, the
administrator can view the available Dynamic
Updates releases, read the release notes but
cannot upload or install the software.

Licenses Controls access to the Licenses node. If you Yes Yes Yes
disable this privilege, the administrator will not see
the Licenses node or be able to view the licenses
installed or activate licenses.
If you set this privilege to read only, the
administrator can view the installed Licenses, but
cannot perform license management functions.

Creating Granular Admin Role Profiles 25

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

Table 1-6 Restricting user access to functions with the Device tab (Continued)

Access Level Enable Read Only Disable

Support Controls access to the Support node. If you Yes Yes Yes
disable this privilege, the administrator will not see
the Support node or be able to access product and
security alerts from Palo Alto Networks or
generate tech support or stats dump files.
If you set this privilege to read only, the
administrator can view the Support node and
access product and security alerts but cannot
generate tech support or stats dump files.

Master Key and Controls access to the Master Key and Yes Yes Yes
Diagnostics Diagnostics node. If you disable this privilege,
the administrator will not see the Master Key and
Diagnostics node or be able to specify a master
key to encrypt private keys on the firewall.
If you set this privilege to read only, the
administrator can view the Master Key and
Diagnostics node and view information about
master keys that have been specified but cannot
add or edit a new master key configuration.

Define User Privacy Settings in the Admin Role Profile

.
Table 1-7 Restricting user access using the Privacy settings

Access Level Description Enable Read Only Disable

Privacy Sets the default state to enable or disable for all of Yes N/A Yes
the privacy settings described below.

Show Full IP When set to disable, full IP addresses obtained by Yes N/A Yes
addresses traffic running through the Palo Alto firewall are
not shown in logs or reports. In place of the IP
addresses that are normally displayed, the relevant
subnet is displayed.
Note that scheduled reports that are displayed in
the interface through Monitor> Reports and
reports that are sent via scheduled emails will still
display full IP addresses. Because of this exception,
we recommend that the following settings within
the Monitor tab be set to disable: Custom Reports,
Application Reports, Threat Reports, URL
Filtering Reports, Traffic Reports and Email Scheduler.

26 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Table 1-7 Restricting user access using the Privacy settings (Continued)

Access Level Description Enable Read Only Disable

Show User Names When set to disable, user names obtained by traffic Yes N/A Yes
in Logs and Reports running through the Palo Alto Networks firewall
are not shown in logs or reports. Columns where
the user names would normally be displayed are
empty.
Note that scheduled reports that are displayed in the
interface through Monitor> Reports or reports that are
sent via the email scheduler will still display user names.
Because of this exception, we recommend that the
following settings within the Monitor tab be set to
disable: Custom Reports, Application Reports, Threat
Reports, URL Filtering Reports, Traffic Reports and
Email Scheduler.

View Pcap Files When set to disable, packet capture files that are Yes N/A Yes
normally available within the Traffic, Threat and
Data Filtering logs are not displayed.

Restrict Admin Access to Commit Functions

Table 1-8 Restricting user access using the Commit setting

Access Level Description Enable Read Only Disable

Commit When set to disable, an admin cannot commit any Yes N/A Yes
changes to a configuration.

Provide Granular Access to Global Settings

Table 1-9 Restricting user access using the Global settings

Access Level Description Enable Read Only Disable

Global Sets the default state to enable or disable for all of the Yes N/A Yes
global settings described below. In effect, this setting
is only for System Alarms at this time.

System Alarms When set to disable, an admin cannot view or Yes N/A Yes
acknowledge alarms that are generated.

Creating Granular Admin Role Profiles 27

Web Interface Access Privilege Details Creating Granular Admin Role Profiles

28 Creating Granular Admin Role Profiles

Creating Granular Admin Role Profiles Web Interface Access Privilege Details

Creating Granular Admin Role Profiles 29