topic Re: Defender for Identity VPN log integration in GlobalProtect Discussions

Defender for Identity VPN log integration

pfox001 — Thu, 14 Jul 2022 04:02:29 GMT

Hi all,

Has anyone been able to configure a PA firewall to forward Radius messages to a MS Defender for Identity sensor as per Microsoft Defender for Identity VPN integration in Microsoft 365 Defender | Microsoft Docs

We are using Azure AD for Global Protect authentication, so not sure that it's possible to send to Radius if not using it to authenticate?

Cheers,

Paul.

Re: Defender for Identity VPN log integration

rlewandowski — Fri, 26 May 2023 16:54:18 GMT

Hi,

I would also like more information on this being a Microsoft Defender for Identity and Palo Alto Networks GlobalProtect VPN customer.

Thank you,

Ryan

Re: Defender for Identity VPN log integration

BPry — Fri, 26 May 2023 22:35:30 GMT

@rlewandowski,

This wouldn't be configured directly on the firewall. FR1109 is the feature request to support accounting directly on the firewall, but it isn't implemented yet. You'll want to either have your RADIUS server that you're authenticating against send accounting messages where you need it, or alternatively you could setup your syslog server to parse the firewall's GlobalProtect authentication events and send the accounting messages to your Defender for Identity sensor.