topic Apple clients and user-id mapping in General Topics https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36504#M26835 <HTML><HEAD></HEAD><BODY><P>Hello All,</P><P><BR />We recently installed two 3020s in active-passive and connected them to our LDAP.&nbsp; We see some users are mapping, but not all.</P><P></P><P>Is there a way for unknown users to authenticate to the Palo Alto so they are given the correct policy?&nbsp; This was a very simple procedure in our previous Lightspeed filter.</P><P></P><P>A local user agent would be ideal!</P><P></P><P>Thanks!</P><P></P><P>Grubbsy</P></BODY></HTML> Fri, 30 May 2014 13:17:10 GMT Grubbsy 2014-05-30T13:17:10Z Apple clients and user-id mapping https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36504#M26835 <HTML><HEAD></HEAD><BODY><P>Hello All,</P><P><BR />We recently installed two 3020s in active-passive and connected them to our LDAP.&nbsp; We see some users are mapping, but not all.</P><P></P><P>Is there a way for unknown users to authenticate to the Palo Alto so they are given the correct policy?&nbsp; This was a very simple procedure in our previous Lightspeed filter.</P><P></P><P>A local user agent would be ideal!</P><P></P><P>Thanks!</P><P></P><P>Grubbsy</P></BODY></HTML> Fri, 30 May 2014 13:17:10 GMT https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36504#M26835 Grubbsy 2014-05-30T13:17:10Z Re: Apple clients and user-id mapping https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36505#M26836 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P> You should use GlobalProtect client (installed on workstations) to ID users on your network. You should look for documents talking about Global Protect and internal gateways. </P></BODY></HTML> Fri, 30 May 2014 14:17:19 GMT https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36505#M26836 cpainchaud 2014-05-30T14:17:19Z Re: Apple clients and user-id mapping https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36506#M26837 <HTML><HEAD></HEAD><BODY><P>Don't you need a license for Global Protect to use the client?</P></BODY></HTML> Fri, 30 May 2014 14:48:43 GMT https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36506#M26837 Grubbsy 2014-05-30T14:48:43Z Re: Apple clients and user-id mapping https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36507#M26838 <HTML><HEAD></HEAD><BODY><P>Hi,</P><P></P><P>are the userID agents connected to every DC or do you only have one? It could be possible that some user are authenticated on a DC which is not monitored from your userID agents. If the users are not mapped and userID is activated for the zone the agents will try to resolve the user with WMI requests. If this doesn't work you can activate captive portal so every connection with an unkown user will have to authenticate through captive portal.</P><P></P><P>If you want to use the Gobal Protect Client it's free if you only use one portal and external gateway.</P></BODY></HTML> Fri, 30 May 2014 14:52:49 GMT https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36507#M26838 Wenar 2014-05-30T14:52:49Z Re: Apple clients and user-id mapping https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36508#M26839 <HTML><HEAD></HEAD><BODY><P>You won't need a licence for your use. Global PRotect client is best way when you are running Macs on your network.</P><P></P><P>PAN can help you configure these through Professional Services consulting</P></BODY></HTML> Fri, 30 May 2014 15:02:17 GMT https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36508#M26839 cpainchaud 2014-05-30T15:02:17Z Re: Apple clients and user-id mapping https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36509#M26840 <HTML><HEAD></HEAD><BODY><P>If you don't want to install Global Protect, you could configure captive portal to kick in for unknown users.</P><P></P><P>Overview and procedure:</P><P></P><P><A href="https://live.paloaltonetworks.com/docs/DOC-1900">Captive Portal Operation in PAN-OS 4.0</A></P><P></P><P>Minor updates in PAN-OS 5:</P><P><A href="https://live.paloaltonetworks.com/docs/DOC-1159">How to Configure Captive Portal</A></P></BODY></HTML> Sat, 31 May 2014 11:06:26 GMT https://live.paloaltonetworks.com/t5/general-topics/apple-clients-and-user-id-mapping/m-p/36509#M26840 pulukas 2014-05-31T11:06:26Z