The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named NewAdmin. This new administrator has to authenticate without inserting any username or password to access the WebUI. What steps should the administrator follow to create the New_Admin Administrator profile?

To configure a local administrator account for passwordless authentication using a client certificate, the firewall must be configured to map the certificate to a locally defined user. This is achieved by creating an administrator account with the "Authentication" type set to "Certificate Based". The administrator's permissions are defined locally using a "Role Based" configuration, which links the account to a specific Admin Role profile. The firewall identifies the user by matching the Common Name (CN) field in the client's certificate to the administrator's username (NewAdmin).

B: A "Dynamic" role is incorrect. This role type is used when permissions are defined and returned by an external authentication server (like RADIUS or TACACS+), not for a local administrator with locally defined privileges. C: An "Authentication Profile" is used for username/password authentication methods (e.g., RADIUS, LDAP, Local Database). Certificate-only authentication requires a "Certificate Profile" to validate the client certificate, not an Authentication Profile. D: This option is incorrect for the same reason as option B. A "Dynamic" role is for externally defined permissions, which contradicts the requirement to create a local administrator profile with customized privileges defined on the firewall.

1. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Configure Certificate-Based Administrator Authentication". The guide states

"To authenticate an administrator using a client certificate... you create an administrator account that references a certificate profile." The procedure involves creating a Role-Based administrator.

Reference Section: Device > Administrators > Add an Administrator Account. The "Administrator Type" must be set to "Role Based" to assign a locally defined Admin Role. The "Authentication" must be set to "Certificate Based".

2. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Device > Administrators". This section details the administrator account settings. It clarifies the "Administrator Type" options:

Role Based: "Select for an administrator with a predefined Admin Role profile."

Dynamic: "Select for a superuser role or for a role defined by a vendor-specific attribute (VSA) on a RADIUS or TACACS+ server."

This confirms that for a local profile with customized privileges

"Role Based" is the correct setting.

3. Palo Alto Networks PAN-OS® Administrator’s Guide 10.2

"Device > Certificate Management > Certificate Profile". This section explains that for certificate-based authentication

a Certificate Profile is required. It specifies how to extract the username from the certificate

with "Common Name" being a standard option for the "Username Field".