Palo Alto Networks- Agentless User ID Tutorial

[@saadahmadkhan5049]

Very well organized demo. I wish you can upload more video tutorial about the PA.

[@brucebennett321]

Hi Jeff, great video thank you. I had a tough time finding out exactly what was needed on the AD side for the service account before. I have a questions about environments with multiple domain controllers. Do you need to connect to all of the domain controllers, or just to a couple (for redundancy)?

[@hiirusha]

well appreciated for your nice and clear explanation! cheers.

[@ANCsounds]

Hi Jeff, thank you for this video tutorial. We have implemented the ad integration on our Palo Alto by following your tutorial!

[@jefftalkington8404]

Thanks for the kind words! Much appreciated.

[@ANCsounds]

It seems that PAN is confused when there is multiple user logged in on a windows computer. Some users did not log out and when new user log in, the IP user mapping is not updated. Do you have any idea on how to fix this?

[@jefftalkington8404]

@@ANCsounds It sounds like this a multi-use system, like terminal services for Citrix or Windows. If that's the case, PANW has a terminal services agent that can be installed on the machine and each user will be identified with a set of source ports to use. It's available for download on the customer support portal. If, however, this is a normal machine and not a terminal services client, the agent/firewall should pick up the changes when it checks in with your AD/syslog server.

[@markusyunianto8826]

Thanks for your explanation, it's very useful 👍

[@brett8706]

Hi Jeff. I know this is a few years old. If I set up a Group Mapping and choose the groups to include, will this mapping update if I change the location of a group in AD? Also, do I need to change this in the Policy, or will it update automatically?

[@scottgoethals6279]

Hi Jeff, Great Video. I have a question. Why did you create the user (service acct) in an OU instead of creating it in the Managed Service Accounts folder? I noticed some documentation lists the steps as creating the user in the Managed Service Account container. I also assume you setup the user so that it's password doesn't expire. Is this correct? A second question, when you setup WMI, (wmimgmt.msc), is this something that would need to be done on each domain controller? Lastly, do you recommend separate LDAP server profiles for each domain controller or is it best to put all DC under one? Thank you.

[@thomasbezak1090]

Note: Recent windows updates break WMI and you now need to setup WinRM/Kerberos to connect to AD for agentless user identification.

[@nickstathakis5263]

Hi Jeff, how does the PA perform the correlation/mapping of the userID and ad-group membership is this within the logs?

[@johnmeyers9961]

Jeff, liked the video. Very informative and fills in a lot of holes from the PA KB articles. Question about WMI polling. Can the PA firewall be set up to read windows syslog data on a syslog server, rather than having it poll the individual AD servers?

[@jefftalkington8404]

Absolutely! This is a common method we use to pull mappings from other sources. The most common is getting IP/User-ID info from wireless controllers or NAC solutions. Here's an article on how to configure it using Aruba wireless as an example. live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Collect-the-User-IP-Mappings-from-a-Syslog-Sender-Using/ta-p/62085

[@crystalhu7502]

Hello Jeff, my AD server is connected well. But when I map user IP, it shows unknown users. Only Paloalto service account can be recognized. Do you know why? Thank you.

[@Black_Swan68761]

Thanks for sharing the video!

[@johnmeyers9961]

Hi. Quick troubleshooting question. (case opened with tech support, but hoping you could help too). I setup my company's webfilter to send syslog data to our PA firewall (the same way I have it send to our syslog server). Then entered it as a syslog sender in Server Monitoring (IP, UDP, Domain, and custom syslog filter profile). But the status does not show "Connected" like in the video. Any ideas if I set it up incorrectly?Also I ran "show user server-monitor state all" from the CLI and I returned counts of zero, but showed the UDP Syslog Listener Service as enabled.

[@johnmeyers9961]

Nevermind, figured it out. Got it working.

[@jefersonantunes3575]

Hi Jeff, great video thank you. I have noticed some anonymous logon cases. Have you ever seen this happen? Most users logged in to Active Directory are identified in the firewall, only a few appear on the monitor as anonymous logon.

[@joananderson2264]

Thanks for this Jeff. Is there any way to exclude users/mac addresses from an internet security profile (i.e., without AD)?

[@jefftalkington8404]

Interesting question- the User-ID process is designed to match a username to an IP address. Since we operate at the network layer, we can't normally see the source/destination mac address. We see only the next hop mac. So...no, if using standard User-ID methods. There is a way to do it though. If we use the Global Protect client on the endpoint and do HIP (Host Information Profile) check, we can pull the machine name or mac address and create an exclusion list based on that. If this is a bit much, you could do a DHCP reservation and create an exclusion around the reserved IP. Hope this helps!

[@joananderson2264]

Thanks Jeff. I would love to create the exclusion list around reserved IPs. I have the IP's already reserved. Can you point me to where the exclusion list is defined in the documentation? I have some users who are using Mac High Sierra and the password override (for URL Filtering) is not working. The site is blocked completely. Earlier Mac versions provide the opportunity to enter the password...as with Windows users via Edge. Chrome blocks sites completely even though override is specified. Had to add a certificate for Windows to allow the override at all. Also, question... User Mapping does nothing unless you have a AD (or Microsoft Exchange, etc.) server, correct? Thanks again.

[@jefftalkington8404]

I'm assuming a couple of things when writing this response but if there isn't an exclusion list capability for a url profile. You can do 'Negate' on source and destination addresses to say that the policy applies to NOT that ip address or range. What I would do, though, is create a policy above the current one and put a permit policy with with reserved IP addresses. We do something like this all the time when users haven't adopted user-id, but have execs or owners that need open access while the rest of the org has a standard internet policy. Execs have the policy above the standard policy and have open access. On the group question- you're right, to get a user-id-to-group mapping you'll need to be connected to either AD or LDAP and ingest group memberships. If you're planning on doing this, make sure you filter groups so that you only get the ones you're using in policy, not the entire AD/LDAP group structure. While it's NORMALLY not an issue, we've seen some companies with 20,000+ AD groups overrun the tables on the NGFW because they didn't enable filtering.

[@shawngibbs3341]

We have this configured, just as in your video...and it works for PC, but not for MAC computers. The MACs are authenticating through AD (Windows AD), but the PA will not see the userID for the MAC users. What is required to make agentless userid work with Windows AD auth work for MAC computers?

[@jefftalkington8404]

Since this is a connection to AD, as long as there is an authentication that takes place to the domain, you should see the user/IP mapping. I would recommend checking the logs in AD and verifying that you're seeing the authentication. After that, contact TAC so they can walk through the issue with you.

[@n3rdpwr]

Works a treat, Thanks!

[@PKS11111]

Hi Jeff, we did it in production, we have noticed inconsistent domain name, sometime user coming as (domain) and some time (domain.loc), Pls suggest

[@jefftalkington8404]

Depending on the number/type of user-id sources, this is not unusual. Palo Alto Networks understands that the firewall may receive multiple formats. There's a couple ways to handle it, but it's all spelled out in the following admin guide walkthrough for how to handle multiple formats. Read it over and definitely look at steps 3 and 4 of the guide. I think it will help. docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/user-id-features/support-for-multiple-username-formats

[@paulojosephzapata905]

Hi Jeff, from your monitor traffic logs @10:35 in your video. Why is it that some traffic from 192.168.35.131 doesn't show the user id? I'm experiencing the same issue, some traffic logs doesn't show the user id.

[@jefftalkington8404]

If I remember right from when I made the video, there was enough of a time gap that my user mappings had timed out. Check the timeout settings in Device->Userid and under the userid agent setup. In a standard corporate environment, 45 minutes is usually plenty for a timeout, but in a lab environment or where users don't login to resources as much, you might have to increase to 2 hours (or 4 or 8).

[@chriscowboyfan]

GREAT VIDEO!

[@p224switch7]

hi Jeff,i have a problem here, i added user group to the rule but not work. i blocked some apps(ex: skype,teamvier...)with that group and allow all all traffic rule below,but user on this group not match blocked rule,only match allow all traffic rule. can you assist me?thank you so much!

[@TheJokeJoker]

This works on PAN-OS 10.0, FYI

[@alexlora6009]

So, as i see in all the videos from youtube, nobody speak about the app User ID Agent must be installed.. so, it is not necessary needed.

[@nikhilchaudhari26]

audio is very very low.....but informative video

[@michaelmarange7534]

Audio is low on the video

[@jefftalkington8404]

I'm playing it from youtube now and volume seems fine. Are you still having the issue, and can you elaborate on the problem?