topic Prisma Access - additional agent config for gateway settings in Prisma Access Discussions

Prisma Access - additional agent config for gateway settings

marceli.namyslo — Mon, 25 May 2020 07:40:55 GMT

Hi,

Does anyone know if there is a possibility for another agent config for gateway settings within the Mobile_User_Template ?
It seems that whatever I put in there it's been ignored and always the DEFAULT config is given to the clients.

On on-premise devices it works as expected.

Thanks

Re: Prisma Access - additional agent config for gateway settings

SuperMario — Thu, 28 May 2020 02:03:47 GMT

Hi @marceli.namyslo ,

Yes, it is possible.
Keep in mind that the configuration will be applied from top to bottom, hence, if the default config is at the top of your configuration list, it will always be used if the user/group and OS are set to match any.

However, if you created a new config, which is at the top and is specific to a set of users/groups, and still is not being picked up, this means that our Prisma Access device is not able to recognize the user-id/group. You may need to open a TAC case to further troubleshoot your user-id configuration.

Note: for Group based configurations should be configured via their distinguished name (CN=xyz,....DC=corp,DC=com)

Here is an example:

Let us know if you have any further questions.

Re: Prisma Access - additional agent config for gateway settings

marceli.namyslo — Wed, 03 Jun 2020 06:53:57 GMT

Hi @SuperMario

Thanks your for response.
You are right, config order and correct Group-format are mandatory for Prisma Access.

I had to create a TAC case.
We found a mismatch between SAML authenticated users and group-mapping from Active-Directory.
pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1281): For domain\username user, domain example does not exist in group-mapping
Once the customer provided his NetBIOS domain name we got a match and it works as expected.

Case closed 🙂