Can User-ID gather user information from Checkpoint Identity Awareness Servers

manny.mekala — Thu, 23 Mar 2023 05:11:09 GMT

Currently involved in some USER-ID work and the user is asking if existing Checkpoint ID Awareness App servers can be re-configured for the Palo-Alto user-ID agent to accept the user information from ? Has anyone tried something like this?

Re: Can User-ID gather user information from Checkpoint Identity Awareness Servers

nikoolayy1 — Thu, 23 Mar 2023 06:46:31 GMT

As this is not palo alto product the option is to use syslog server/SIEM and send the Checkpoint logs to it and then palo alto work with them:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping

You may also use an API but I think this will make things more complex:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/send-user-mappings-to-user-id-using-the-xml-api

Also if the checkpoint servers support WinRM this can be option or if they sync the users with Windows Server 2012 Active Directory and Microsoft Exchange Server 2012 or later versions of both, this can also be an option.

You will have read what Checkpoint supports and if you have syslog/siem servers in your networks or if the AD/Exchange can also be used.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/map-ip-addresses-to-users/configure-server-monitoring-using-winrm

topic Can User-ID gather user information from Checkpoint Identity Awareness Servers in Next-Generation Firewall Discussions

Can User-ID gather user information from Checkpoint Identity Awareness Servers

Re: Can User-ID gather user information from Checkpoint Identity Awareness Servers