topic Re: User-ID mapping integration for Multi-Domain AD server in Integration Discussions

User-ID mapping integration for Multi-Domain AD server

tamilvanan — Sun, 21 Nov 2021 09:36:09 GMT

Hi All,

We are using windows based User-ID agent on Palo alto firewall for user-id mapping.

We have an existing setup with AD domain abc.com for which the User-ID mapping is implemented on PA Firewall and User ID agent is installed on the abc.com domain controller and it is working fine without any issues.

Now we are creating an completely new set of domain xyz.com with dedicated AD Server. We are able to implement group mapping for xyz.com domain on firewall.

Now we are planning to install User-ID agent on the xyz.com domain controller also and trying to configure Agent based User-ID mapping for the same.

I had came across some articles which explains User-ID mapping on Palo Alto firewall cannot be implemented for two completely different domains.

Thanks in advance!!

Re: User-ID mapping integration for Multi-Domain AD server

ShaiW — Tue, 23 Nov 2021 07:35:05 GMT

I have done this a few weeks ago. The firewall itself can connect directly ('integrated User ID') to AD servers but this can only be done for 1 domain and maybe that is what you read in articles. The second domain must use User-ID Agent installed on a member server of that domain. There is no problem with the first domain also using User-ID Agent instead of the integrated method.

You need to have 2 LDAP profiles, and 2 Group Mapping profiles - 1 for each domain.

The User-ID Agent will send IP-to-User mapping for it's domain and if you type 'show user ip-user-mapping all' you should be able to see usernames from 2 domains, such as 'microsoft\username1' & 'contoso\username2'.

Hope this helps,

Shai