topic auto-tagging registration on remote user-id agent in General Topics

auto-tagging registration on remote user-id agent

ppk_vs — Fri, 21 Jan 2022 13:00:25 GMT

Hello colleagues,

did someone manage to use dynamic tag registration on the remote user-id agent? I cannot find any explanation in documentation or community discussions. It is written in the manual that need to create a http profile

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/monitoring/forward-logs-to-an-https-destination.html

So, first of all, there should be some login/password - what is this login, where is it configured on the user-id agent?

The port in the example is 443. But we don't have any service running on the 443 on the servers with user-id agent. Should it be the same port on which the paloalto firewall connects, 5007?

What should be done with a certificate on the user-id agent, do I need to generate some?

Thanks in advance for any working example.

Re: auto-tagging registration on remote user-id agent

S.Cantwell — Wed, 02 Feb 2022 02:31:22 GMT

In order to use tagging, you need to use a "built in" action from the Log Fwding profile.

When a security policy is hit, the traffic is logged to a log fwding profile, that has a built in action.

The built in action will apply your tag dynamically.

I am not sure how to apply a log to a remote user agent. That piece of software is for identifying users.

Not sure where/how this come into use.

Can you provide your use case?

Re: auto-tagging registration on remote user-id agent

ppk_vs — Fri, 04 Feb 2022 20:26:55 GMT

Hello Steve,

yes, correct, there is a built-in action, and in this built-in action we have a mandatory field - registration, we we can choose from three options: Local User-ID, Panorama User-ID, Remote User-ID.

We don't have panorama, and we don't have local user-id on the firewall, so, I guess, the only option is to use remote User-ID?