topic Re: User ID agent / User-IP-Mapping issue in General Topics

User ID agent / User-IP-Mapping issue

rimbalt — Thu, 03 May 2012 21:53:18 GMT

Hello,

I have simple request: created access rule based by group.(and this part looks clear and working to me). Problem that i can make User-IP mapping to work correctly. With desktops i do not see any issues because their users do not change mostly at all. Major problem is with laptops. Users migrates between meeting rooms, use wifi and comes back to work place. IP may change in an hour about 4 times. how to make palo to give access according group if i see that even first level ip-mapping is not working. Or how to make IP-mapping to work correctly?

Another thing on any commit , looks like internet and user identification (ip-maping) is also temporary lost

thanks.

Re: User ID agent / User-IP-Mapping issue

sjamaluddin — Mon, 07 May 2012 21:51:42 GMT

If you have laptop users that change IP more frequently than the timeout values, you may want to enable some kind of probing eg, NETBIOS or WMI probing which checks the user @ IP w.x.y.z every 20 min etc.

Re: User ID agent / User-IP-Mapping issue

essnet — Tue, 08 May 2012 16:44:00 GMT

Hello,

If it is just for internet access, I would suggest you use Captive portal with NTLM authentication.

If it's for internal filtering (like datacenter secured resource access) and you have a large network, ActiveDirectory and people switch from wifi to wired network frequently then only GlobalProtect can bring you 100% success . AD log monitoring has many drawbacks and wll work for 95% of people, but yet it means 5% of your users will open tickets everyday because they can't access a resource.

Re: User ID agent / User-IP-Mapping issue

rimbalt — Tue, 08 May 2012 19:35:38 GMT

About WMI: Yes this is the one but not the best solution. I will try to do it with 10 minutes interval.

About Captive portal: I think it wont work for ftp users.

thanks. hoping to make palo working correctly.