topic Re: Recording User in Logs in General Topics

Recording User in Logs

MGiannetto — Wed, 10 Nov 2010 14:22:07 GMT

This should be an easy one. Just looking for confirmation.

The only way to get user information in traffic/url/threat logs is to a) use the PAN User Agent to query AD/WMI or b) setup a caputive portal. Is this correct?

We have a WPA2 wireless network available for students on campus. They authenticate via 802.1x to a RADIUS server to access it. They use personal computers. If I wanted to get user data here, I'd have to setup a captive portal?

Thanks!

Re: Recording User in Logs

pkruse — Thu, 11 Nov 2010 17:36:18 GMT

You will need to be using either the Pan-Agent or the TS_agent as applicable. Have your Zone setup to enable User Identification on the zone/zones you will want to monitor this way and then your logs will reflect user based traffic.

Re: Recording User in Logs

will2097 — Thu, 11 Nov 2010 18:42:13 GMT

Hello

Yes Captive Portal is probably the way forward. The Palo Alto agents (AD/LDAP/TS) require, one-way-or-another, a domain account, and a login event to that account, which I'm guessing they don't have.

All the best,

Will