topic pass on user-id information in General Topics

pass on user-id information

mr.linus — Tue, 17 Sep 2013 08:47:26 GMT

Hi All,

Setup

- We got 2 PA clusters with a leased line between them, joining two offices of the same company.

- Both offices have their own AD, servers, ...

- We have GlobalProtect configured on both devices.

- We have PanOS User-Id configured (so no agent) on both devices

- We have a user based security rule providing a "support" user access to certain devices.

=> This is all working fine, but only if we use each offices his local GlobalProtect connection. In other words, we can only reach servers in office A if we login to the GlobalProtect of office A.

Goal

- We now want to be able to GlobalProtect to office A, but reach servers on office B, with user restriction (this last part is the important part).

Problem

- When we create a rule on the PA of office B, to allow access from connection coming from office A to certain servers, the PA of office B does not know the user since it was authenticated via GlobalProtect on the PA of office A. Hence, we can not create user based security rules.

Solution?

- Either give the GlobalProtect "support" user a fixed IP (that way we can work IP based instead of user based). But this is not possible I think, only by creating a separate portal + gateway?

- Passing on the user-ip mapping from office A to office B. But we only want the user-ip info of the GlobalProtect users (which are local users: same user exist on both devices). Is this possible, and if yes, how do we configure this?

Kind regards

Re: pass on user-id information

mr.linus — Tue, 17 Sep 2013 12:16:11 GMT

I got it to work by:

- adding a Pan Agent with ip = mgmt ip of the other PA (on port 5007)

- enabling user-id under the management interface settings (device/setup)

- enable user-id identification on the zones connecting the two PAs

=> but we still only want to exchange the GP users, not all users. Is that possible?

Re: pass on user-id information

UhMayYeah — Thu, 19 Sep 2013 05:04:36 GMT

Hello ,

At this moment ,feature to allow redistribution of GP user-ip mappings, is not available.

Please consult your SE to discuss the option of filing a feature request.

Re: pass on user-id information

UhMayYeah — Thu, 19 Sep 2013 09:13:38 GMT

Just to be clear, with OS-5.0 you may use to the User-ID collector feature to pass on User-IP mappings (Captive Portal, GP mappings) from firewall A to B (User ID collector OS-5.0) firewall.

But the option to selectively pass only GP User-IP mappings is not available.

Ref How to Configure and Verify User-ID Collector in PAN-OS 5.0