topic Re: Two client account on one PC in General Topics

Two client account on one PC

KiCheon.Lee — Tue, 06 Aug 2013 09:31:15 GMT

Hello

Each users have two and four accounts in their office.

All account are authenticated by Active-Directoy.

Each users use several accounts on one PC at the same time.

For example,

Mr, A has 'AAA' account and 'aaa' account.

He uses 'AAA' account when connect Internet.

He uses 'aaa' account when connect office E-Mail.

He uses two accounts on one PC(one IP) at the same time.

I know that one IP has only one User-ID in PaloAlto FW.

My customer wants to enforce security policy about only 'AAA' account.

But PA doesn't enforce security policy when Mr, A use 'aaa' account.

Someone help me!

Are there good ideas resolved?

Re: Two client account on one PC

VinceM — Tue, 06 Aug 2013 10:00:43 GMT

Hi,

You can create ignore list for unwanted accounted but the issue is, User A use AAA account in AD, he will be known as AAA in Palo but it wants to connect to email with aaa and aaa is in ignore list, your user will move to "unknown".

In my minf, the only way to do that should be to open two different OS sesssion then two IP then two account.

hope it help.

Re: Two client account on one PC

KiCheon.Lee — Tue, 06 Aug 2013 11:29:05 GMT

Thanks, VinceM.

Where is ignore list menu on agentless?

And Is it possible that ignore 'aaa' account is put into ignore list?? I know to configure only ip address.

Re: Two client account on one PC

VinceM — Tue, 06 Aug 2013 11:48:32 GMT

Look:

https://live.paloaltonetworks.com/docs/DOC-4278#comment-3404

https://live.paloaltonetworks.com/message/22261#22261

Re: Two client account on one PC

mbutt — Tue, 06 Aug 2013 18:21:48 GMT

If you are on 4.1.x OS version then you will have user id agent installed on the DC.

Then you can look at the following docs to create an ignore user list

https://live.paloaltonetworks.com/docs/DOC-1987

https://live.paloaltonetworks.com/docs/DOC-1116

If you are on 5.0.x and are using agentless user id agent then as Vince pointed you can use those docs as reference

https://live.paloaltonetworks.com/docs/DOC-4278#comment-3404

https://live.paloaltonetworks.com/message/22261#22261

Hope this helps.

Thanks