topic Re: How to track user ip changes while using the UIA PAN agent? in General Topics

How to track user ip changes while using the UIA PAN agent?

asia — Mon, 15 Mar 2010 15:48:14 GMT

Hello,

I'am using the PAN agent with AD to indentifie users, and i noticed that whene users chage there ip adresses (going on wifi or vpn...) the agent is not able to establish the new mapping. Is there any solution to this issue. Is there any évolution of the agent in the 3.1 version of PAN-OS. And if it will be some solutions, is it working for linux users?

Thank you in advance.

Asia.

Re: How to track user ip changes while using the UIA PAN agent?

swhyte — Mon, 15 Mar 2010 21:19:33 GMT

Hi Asia,

when users use vpn or wi fy, there is actually a radius request made to AD rather than rather than a logon even that the Paloalto user id logs. That is why the user id does not pick up the change. Currently there isn't a future plan for this. Also, currently the only solution we have for linux users is captive portal. In 3.1, there may be a plan for a static mapping on the Paloalto device for non AD users.

thanks,

Re: How to track user ip changes while using the UIA PAN agent?

asia — Tue, 16 Mar 2010 11:10:12 GMT

Thank you swhyte :smileyplain:.

Re: How to track user ip changes while using the UIA PAN agent?

fw_admin — Tue, 16 Mar 2010 13:24:28 GMT

Hi,

In our network, we could have a similar problem. We have users in Active Directory, but the access method could be different. That means that one user could be logged in his corporate PC with an IP address (internal) at 9:00 a.m. and after this, could be logged from his tablet-PC or a PDA via UMTS which another IP at 11:00 a.m.

The user in A.D. will be the same, but the associated IP will be different and the PanAgent should be capable of detecting this change.

Is this your issue?

Regards,

Re: How to track user ip changes while using the UIA PAN agent?

asia — Tue, 16 Mar 2010 13:48:52 GMT

Hi fw-admin,

Not exactly, whene the user logs in from différent locations he is always seen by the agent. My issue is whene the user disconnect his pc from the network without loosing his windows session and re-connect from another location (différent subnet, wifi or vpn...), because this kind of action dont request AD login to function, the new user-IP mapping is not detected by the agent. So i'am trying to find a solution, may be an AD events or a connection wich trigger the mapping establishment on the agent.

Regards