topic Re: PAN-Agent - Domain on User-ID in General Topics

PAN-Agent - Domain on User-ID

blacksan — Fri, 09 Apr 2010 14:10:53 GMT

How can I remove the Domain information from the User information?

Domain/UserID to just UserID.

I notice that I am getting this information from the PAN-Agent and the Terminal-Agent.

Reason: I am also using LDAP Authentication for SSL-VPN/Admin which does not use the Domain information so I have to add the user account manually to to the Allow-List on the Authentication Profile instead of using the information from the PAN-Agent User list.

Re: PAN-Agent - Domain on User-ID

swhyte — Mon, 12 Apr 2010 21:53:11 GMT

hello Blacksan,

there isn't a way to strip off the domain information from the user information gathered from the User identification via the Paloalto device. You would have to do this manually outside of the Pan device (perhaps via a word editor) then manually import the altered list back into the allow list for the authentication profile.

Re: PAN-Agent - Domain on User-ID

blacksan — Wed, 23 Jun 2010 16:12:46 GMT

ok, how about reverse the question.

LDAP Authentication vs RADIUS Authentication.

Under Radius, we have the option to add the domain so we can use the PAN-Agent information for authentication & policy.

Do we have the same options under LDAP hidden somewhere?

Re: PAN-Agent - Domain on User-ID

npiagentini — Wed, 11 May 2011 16:19:38 GMT

You do have this ability. The LDAP server object includes a Domain field. This field will be used by the firewall to match users enumerated from LDAP with users mapped via the TS agent or the AD agent.

Nick