CIE for user/group mapping for firewall on-premise

RCastro — Mon, 24 Nov 2025 19:11:39 GMT

Hi Community,

I'm working on implementing user and group mapping for security policies on our on-premises firewall and wanted to verify my understanding of the architecture before proceeding further.

Current Setup:

On-prem Palo Alto firewall with GlobalProtect configured
GlobalProtect authentication: SAML via Azure Entra ID (working perfectly)
Cloud Identity Engine (CIE) tenant configured with directory sync enabled
Firewall added as a managed device in CIE tenant
Followed the documentation here: Configure the Cloud Identity Engine as a Mapping Source on the Firewall

What I've Done:

Configured CIE as a User-ID source under Device > User Identification > Cloud Identity Engine
Enabled directory sync in CIE with Azure Entra ID
Users authenticate successfully via GlobalProtect with SAML

My Understanding: Based on my research, here's what should happen:

GlobalProtect automatically provides IP-to-username mapping when users authenticate via SAML
CIE (configured as User-ID source) provides the group membership information
The firewall combines both to apply security policies based on user/group

The Question: The documentation includes a verification step that says: "On the client device, use the browser to access a web page that requires authentication" for testing the mapping.

My understanding is that this browser-based authentication step is just one verification method (typically for Captive Portal scenarios), and that with GlobalProtect + SAML, the user-to-IP mapping should happen automatically when users connect to the VPN. I should be able to verify the mapping simply by running show user ip-user-mapping all after GlobalProtect authentication, without needing any browser-based authentication.

Am I missing something here? Should I expect the mapping to work with just GlobalProtect SAML authentication, or is there an additional configuration step I need to enable browser-based authentication?

Any insights from those who have implemented this architecture would be greatly appreciated!

Thanks in advance!

Re: CIE for user/group mapping for firewall on-premise

TomYoung — Fri, 16 Jan 2026 00:36:55 GMT

Hi @RCastro ,

Your understanding is correct. GP will provide the user-IP mapping and CIE will provide the user-group mapping. One additional step that I like to take is to verify the usernames in the group mapping are identical to the usernames in the IP mapping.

> show user group list > show user group name "<group-name>"

If the usernames don't match exactly, the group mapping will not occur. Since you are using Azure for both IP and group mapping, the usernames should be identical.

Thanks,

Tom

topic Re: CIE for user/group mapping for firewall on-premise in General Topics

CIE for user/group mapping for firewall on-premise

Re: CIE for user/group mapping for firewall on-premise