topic Re: Static user-id to IP-address mapping in General Topics

Static user-id to IP-address mapping

Charles_Cabico — Sun, 02 Aug 2015 23:45:11 GMT

Hi All,

Is there a way in PanOS 6.1.x to manually map a user-id to an ip-address.

Or is there a way to set an IP-address to be exempt from the user-id mapping policy.

I have PA-500s being staged behind a generic firewall inside a production network with a PA-3000 on the perimeter. The PA-500s NAT their external connections via the generic firewall and cannot establish connection to the PA update server without connecting a laptop behind the generic fw and authenticating via the captive portal.

Regards,

Charles

Re: Static user-id to IP-address mapping

pulukas — Mon, 03 Aug 2015 00:13:25 GMT

On the bottom of the User-ID setup screen you can enter exclude addresses that will be ignored for user-ID.

Re: Static user-id to IP-address mapping

Charles_Cabico — Mon, 03 Aug 2015 05:55:13 GMT

Thanks Steven. Just to confirm that if I follow this route, then I would need to explicitly define all networks to be user-id'd under the include action.

How the User-ID Agent Include/Exclude List Works

Re: Static user-id to IP-address mapping

pulukas — Mon, 03 Aug 2015 10:51:17 GMT

Yes, once you setup this section it is comprehensive on both exclude and include networks.

Re: Static user-id to IP-address mapping

glastra1 — Wed, 05 Aug 2015 19:40:12 GMT

Or you can also add an exception policy for your PA500 ip address in the top of captive portal policies. Just need to configure action as "no-captive-portal"

from: PA500_IP -Trust

To: any -Untrust

Actions: no-captive-portal

you cand test the policy using the following command

test cp-policy-match from <value>|<any> to <value>|<any> source <ip/netmask> destination <ip/netmask>

Regards,

Re: Static user-id to IP-address mapping

MRosloniec — Wed, 05 Aug 2015 19:42:44 GMT

Keep in mind that the Agents process the include / exclude networks list in a top-down fashion just like the firewalls do policy. What I did to keep from having to manually identify all of the networks I wanted to include, is I put all of my excludes at the top and then created 3 include entries to cover all of the RFC1918 addresses.