topic Re: Dynamic Decryption sources in Next-Generation Firewall Discussions

Dynamic Decryption sources

MNoble — Tue, 07 May 2024 16:17:34 GMT

Hello all,

We are slowly rolling out Decryption to folks and was wondering if there is a way to dynamically add users, similar to user-ID.

My current way is manually adding computer objects which was fine for the first 15 computers but is starting to get tedious.

I know I can import objects using the API but am looking for a more dynamic method.

Thanks

Re: Dynamic Decryption sources

jfernandez1 — Tue, 07 May 2024 16:37:54 GMT

Hello friend!

I think your requirement might be solved using Dynamic User Groups, you can find more information in:

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-dynamic-user-groups-in-policy

Mark my comment as solved if you think it solved your doubt,

Re: Dynamic Decryption sources

MNoble — Tue, 07 May 2024 17:36:46 GMT

Thanks for Reply, I would still need to manually enter objects. Also, I think Dynamic user Groups use Tags for filtering which is not what I'm looking for.

Re: Dynamic Decryption sources

S_Williams901 — Tue, 07 May 2024 18:33:09 GMT

Not sure there is a more automated way to achieve this outside of API. You could use Terraform to add objects on the fly from an excel spread sheet if you knew how to do that. Also why not just use user-id for the decryption policy and make an AD group for "Decryption_Users" and add the users to that group which would then hit the policy?

Re: Dynamic Decryption sources

OtakarKlier — Tue, 07 May 2024 20:55:57 GMT

Hello,

Two ways I can think of to achieve this.

User-id

If you have user-id setup with active directory, the use of this can be the solution you are looking for. Create a group and add that group to your decryption policy. That way when you add users to this group in AD, it will propagate to the PAN and their traffic will hit the decrypt policy.

Source IP's

Use the source IP's of subnets, single addresses, or a group of addresses and add them to the decryption policy.

Hope this helps.

Re: Dynamic Decryption sources

MNoble — Wed, 08 May 2024 13:59:59 GMT

Thanks for the Reply,

I was thinking of using user-id's but was not sure if that was supported. so, I would just add the AD group to 'group mapping' under 'user identification' than apply the group to the decryption policy?

Re: Dynamic Decryption sources

OtakarKlier — Wed, 08 May 2024 14:09:48 GMT

Hello,

Exactly, its that simple. Just remember that its not instant from when you add someone to the group and it starts decrypting. The PAN needs to update the AD group, used to be 60 minutes by default. But can be changed to meet your needs.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRyCAK

Regards,

Re: Dynamic Decryption sources

MNoble — Wed, 08 May 2024 14:12:43 GMT

Thanks again! Marked as Solution 🙂

Re: Dynamic Decryption sources

OtakarKlier — Wed, 08 May 2024 14:13:56 GMT

Hello,

Best of luck! If you have additional questions, feel free to post. We are here to help!

Cheers!