Prisma Access User-ID mappings verification

zGomez — Wed, 11 May 2022 10:20:40 GMT

Hi,

We have configured prisma access to retrieve user-id info from a firewall on premise in the Remote Network device template.

Is there a way to verify the user-ip mappings on prisma access?
Like you have on on-prem firewall?

show user ip-user-mapping ip

Re: Prisma Access User-ID mappings verification

nikoolayy1 — Wed, 11 May 2022 13:49:09 GMT

If you use cloud identity engine you can check what info it has: https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/collect-user-and-group-information-using-the-cloud-identity-engine

Other than that asking the TAC as they can run cli commands on the Prisma Access firewalls or another way is to have a local firewall to sync its user to ip mapping from Prisma Access and in this way you can check what Prisma Access has given to the on-prem firewall:

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/configure-user-based-policies-with-prisma-access/redistribute-userid-information-for-users-and-networks

There is an interesting topic about this not for prisma access but still as you can try the prisma access api but I have not used it myself:

https://live.paloaltonetworks.com/t5/general-topics/how-to-see-uesr-ip-mapping-in-panorama-gui/td-p/460389

https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama-admin/prisma-access-overview/prisma-access-apis

For Prisma Access without Panorama:

https://www.youtube.com/watch?v=1T0xE52Z1GA

This is the limitation of all firewall or proxy as a service cloud based systems as you don't manage the infrastructure but you have less control and visability.

topic Re: Prisma Access User-ID mappings verification in Prisma Access Discussions

Prisma Access User-ID mappings verification

Re: Prisma Access User-ID mappings verification