Palo Alto Networks Certified Network Security Engineer (PCNSE)Plan and DesignMedium
A global organization is deploying Panorama to manage 200 Palo Alto Networks firewalls across various regions. The security team needs to ensure that administrators in each region can only manage firewalls within their respective region and have read-only access to firewall logs from other regions. Which Panorama design feature is essential for implementing this granular access control?
- ALog Collectors and Log Collector Groups
- BManaged Devices and Device State
- CDevice Groups and Templates
- DRole-Based Access Control (RBAC) and Admin Roles
Show answer & explanationAnswer & explanation
Correct answer: D. Role-Based Access Control (RBAC) and Admin Roles
Role-Based Access Control (RBAC) with custom Admin Roles is essential for implementing granular access control in Panorama. It allows administrators to define specific permissions for users, restricting their access to device groups, templates, and log data based on their assigned roles and ensuring they can only manage firewalls and view logs relevant to their region.
Why the other options are wrong
- A. Log Collectors and Log Collector Groups are for log aggregation and storage, not for restricting administrator access to specific logs or devices.
- B. Managed Devices and Device State simply list the firewalls managed by Panorama and their operational status, not access control mechanisms.
- C. Device Groups and Templates are used for configuration management and standardization, not directly for granular administrator access control.
Panorama RBAC
Panorama Role-Based Access Control (RBAC) allows administrators to define custom roles with specific permissions, restricting user access to managed firewalls, device groups, templates, and log data.
- Enforces least privilege principle.
- Controls access to configuration, operational, and log data.
- Uses Admin Roles to define permissions.
- Scalable for large, multi-tenant environments.
Memory trick: For Panorama, 'ROLES' define 'WHO' can do 'WHAT' and 'WHERE'.