topic Re: Agentless User-ID with PAN5.x - AD Configuration in General Topics

Agentless User-ID with PAN5.x - AD Configuration

cindyb — Tue, 26 Feb 2013 17:41:26 GMT

I have read the tech article "How to Configure Agentless User-ID in PAN- OS 5.0.x"

I'd love to see this document broken into two docs - one that I can send out to customers to prepare for POC - the AD user account setup portion without the PAN firewall config portion . . . does this already exist somewhere?

Re: Agentless User-ID with PAN5.x - AD Configuration

dieter_b — Wed, 27 Feb 2013 13:55:12 GMT

While on the subject: May have been asked before, but what are the advantages/disadvantages of going agentless vs with agent.

How do they compare in terms of reliability (user to ip mapping integrity), performance ?

What does PA recommend ?

Re: Agentless User-ID with PAN5.x - AD Configuration

BobW — Wed, 27 Feb 2013 15:33:23 GMT

At the Ignite conference they talked about the fact that they were able to make the agentless User-ID process very efficient. Apparently the process is much faster at identifying when a new domain user, or exchange user, logs in. I suppose it would be handy to have one less piece in the puzzle as well.

Bob

Re: Agentless User-ID with PAN5.x - AD Configuration

charger — Wed, 27 Feb 2013 22:55:44 GMT

Where did you find this tech article? I searched and can't locate it.

Re: Agentless User-ID with PAN5.x - AD Configuration

SCoupland — Wed, 27 Feb 2013 23:11:36 GMT

The article can be located here - How to Configure Agentless User-ID in PAN-OS 5.0.x

Personally if I only wanted the customer to setup the user account on the domain and not see the firewall configuration I would write my own version of this with own screenshots so then I could put my own company's branding on the document.

Re: Agentless User-ID with PAN5.x - AD Configuration

dieter_b — Thu, 28 Feb 2013 07:15:50 GMT

Anyone with PAN to confirm this ?

Re: Agentless User-ID with PAN5.x - AD Configuration

cindyb — Thu, 28 Feb 2013 12:58:18 GMT

No one from Palo Alto yet. I will work on rounding someone up. What I have been told is. . .

USER-ID Update

It is no longer necessary to use windows machine for one AD server

It is best practice to setup filters to only enumerate groups that will be used in a policy - groups are ONLY used to create policy.

The (windows) agent can still be used to check in with multiple AD servers. As you probably know, it looks for kerberos tickets and also polls via Netbios or WMI to see if anyone has moved.

Also, it is suggested to use agent if you don't want to use the control plane of the firewall for additional processing.

Hope that helps a little for now. . .