Rename Signed Protocol with airSlate SignNow

Rename signed protocol

i often get asked what is the best way to rename the admin account in a palo alto network's firewall and the answer is you don't the solution is to create a new account and then delete the old one but there are some things you should be doing to secure that new account and that's what i want to show you on today's video first thing we're going to do is log into the firewall using our default admin account next thing we're going to do is come over here to the device tab administrators and you see we cannot rename this account for a couple reasons it's the default and we're logged in as it so we're going to create a new account we're going to call this local admin just like this and we're going to give it a password something secure it does need to be a super user i'm going to click ok and then commit this commit's done i'm going to log out we're going to log in as local admin now the significance of logging in as local admin is really so that we can grab a filter string out of the system log indicating that local admin had just logged in and then we can notify our entire team whenever that event just happened now you can see there's some historical logs from when i was testing this previously but the key thing we want is right here this filter string that description contains authenticated for user local admin make sure that this is something you grab out of the log so that there's no typos or whatever then you want to come over here to the device tab we're going to go down to our log settings and we're going to send a system log entry via email so i've got my email profile already created here now you can see this is where you'd you'd set that up the destination defined in this email profile should be the entire it team that manages firewalls at your organization so that when this log entry is seen right we get an email that goes to every one of the firewall admins indicating a few things one someone used this emergency access or this local admin account that is or should not be normal behavior everyone should be logging in with an ldap radius tacx account which we'll create here in a second but you definitely want to set this up so that whenever that emergency account is used everyone is notified then you can follow up to see did this account get compromised somehow did somebody uh key log the password and and they're using it for abuse or is there an admin who's kind of being lazy or forgot their password we should chastise that admin because local admin shouldn't be used in that scenario um and really just used in emergency scenarios so anyway let's put in our name of...