topic Re: Identified User and NAT in General Topics

Identified User and NAT

kdd — Thu, 23 Jan 2014 13:04:38 GMT

Hi,

for certain of our users is it aloud to use firefox. they are identified by their username. But if the want to go to internet they have to be "NATted" . It is possible and when how to create a NAT-Rule? What is known: username and the application.

Best regards

Klaus

Re: Identified User and NAT

Gregoux — Thu, 23 Jan 2014 13:45:58 GMT

you could create a nat rule base on group or username and base on an custom application

custom application with signature base on the user-agent header that contain firefox.

Re: Identified User and NAT

Gregoux — Thu, 23 Jan 2014 14:00:32 GMT

Custom Application Signatures

to create your custom app

and to identify user you need user id

Installation and Provisioning of the User Agent

User-ID Agent Setup Tips

Re: Identified User and NAT

kdd — Thu, 23 Jan 2014 14:24:31 GMT

we use PAN-OS 5.0.5 and in NAT-Rules there is no column for users.

the custom application still exists.

Re: Identified User and NAT

Phoenix — Thu, 23 Jan 2014 14:37:06 GMT

Hello Kdd,

User names or User groups are defined in the security policy.

In the Nat rules the options available are source IPs and source zone and destination zone to indicate Nat rules. Later select source Nat or destination Nat.

Nat need not have the Usernames because all this is controlled from the security rules ie user and custom application ( firefox browser here )

Docs would help:

Understanding PAN-OS NAT

Security Policy Guidelines

Re: Identified User and NAT

Gregoux — Thu, 23 Jan 2014 14:41:07 GMT

Yes I agree