topic User-ID PanOS 4.1 in General Topics

User-ID PanOS 4.1

u10723 — Fri, 02 Mar 2012 16:27:03 GMT

In regard to user identification of traffic, older implementations of PAN we would install the PAN-Agent, but after reading a bit more on the 4.1 it seems I would no longer need to use the agent in an Active Directory installation.

Is there any documentation on how to do this for multiple DCs in multiple domains? We are in the midst of a domain transition.

If the agent is still required for 4.1 installations? If so what premissions are needed on the member server, user, and domain controllers for it to work?

If the agent is not required are there any limitations to the number of DCs that can be added to the groups?

Can I also use the new way of doing profiles to allow usernames to have certain levels of administration of the appliance itself?

Re: User-ID PanOS 4.1

sdurga — Fri, 02 Mar 2012 23:07:24 GMT

I hope this document will assist you in your upgrade to new user id agent 4.1.

https://live.paloaltonetworks.com/docs/DOC-3120

Tx,

Sandeep T

Re: User-ID PanOS 4.1

sdurga — Fri, 02 Mar 2012 23:16:28 GMT

In 4.1 you still need the user-id agent to be installed on the AD server. This user-id agent should be provided with the adminstrator username and password for retrieving the info from the windows security logs. It same as it was in panagent. the only major difference is that for grouping of users, you have to create ldap server profiles which is not necessary in panagent.

Re: User-ID PanOS 4.1

u10723 — Sat, 03 Mar 2012 16:28:16 GMT

any idea on what user premissions are required to read exchange logs? I have added the user to the Event Log Readers group and can connect/poll from the Domain Controller, but not from Exchange.

Re: User-ID PanOS 4.1

kalavi — Tue, 06 Mar 2012 00:25:18 GMT

Hi,

The login credentials should have the Admin rights to read and write the logs.

Let us know if you have any more questions.

Thanks,

Khubaib

Re: User-ID PanOS 4.1

u10723 — Tue, 06 Mar 2012 15:34:41 GMT

Do you know the admin rights name or group? I can't give this service domain administrator rights as for security purposes.

Re: User-ID PanOS 4.1

sjamaluddin — Tue, 13 Mar 2012 15:31:03 GMT

You can grant another user admin rights to READ only

You may want to review documents on the MS knowledge base e.g.

http://support.microsoft.com/kb/323076

As this is a setting on the Active Directory so best that you contact MS Support for how to create and grant READ ONLY access to user/admin accounts.