topic User Identification Agent with Active Directory in General Topics https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4926#M3621 <HTML><HEAD></HEAD><BODY><P>I know that PA Firewall uses MGT interface to connect to user Identification Agent, I know that most of the other services can be set to use any other interface with the "Service Route Configuration" commands.</P><P></P><P>Is there any method to use any other interface as a source for communication with User Identification Agent? </P><P></P><P>Thanks in advance</P></BODY></HTML> Mon, 21 Dec 2009 23:21:43 GMT a.cadarso 2009-12-21T23:21:43Z User Identification Agent with Active Directory https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4926#M3621 <HTML><HEAD></HEAD><BODY><P>I know that PA Firewall uses MGT interface to connect to user Identification Agent, I know that most of the other services can be set to use any other interface with the "Service Route Configuration" commands.</P><P></P><P>Is there any method to use any other interface as a source for communication with User Identification Agent? </P><P></P><P>Thanks in advance</P></BODY></HTML> Mon, 21 Dec 2009 23:21:43 GMT https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4926#M3621 a.cadarso 2009-12-21T23:21:43Z Re: User Identification Agent with Active Directory https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4927#M3622 <HTML><HEAD></HEAD><BODY><P><!--[if !mso]> <style> v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} </style> <![endif]--><!--[if gte mso 10]> <style> /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman","serif"; mso-fareast-font-family:"Times New Roman";} </style> <![endif]--><SPAN style="font-size: 10pt; font-family: &amp;quot;Arial&amp;quot;,&amp;quot;sans-serif&amp;quot;; color: navy;"><!--[if gte vml 1]><v:shapetype  id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t"  path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f"> <v:stroke joinstyle="miter" ></v:stroke> <v:formulas> <v:f eqn="if lineDrawn pixelLineWidth 0" ></v:f> <v:f eqn="sum @0 1 0" ></v:f> <v:f eqn="sum 0 0 @1" ></v:f> <v:f eqn="prod @2 1 2" ></v:f> <v:f eqn="prod @3 21600 pixelWidth" ></v:f> <v:f eqn="prod @3 21600 pixelHeight" ></v:f> <v:f eqn="sum @0 0 1" ></v:f> <v:f eqn="prod @6 1 2" ></v:f> <v:f eqn="prod @7 21600 pixelWidth" ></v:f> <v:f eqn="sum @8 21600 0" ></v:f> <v:f eqn="prod @7 21600 pixelHeight" ></v:f> <v:f eqn="sum @10 21600 0" ></v:f> </v:formulas> <v:path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect" ></v:path> <o:lock v:ext="edit" aspectratio="t" ></o:lock> </v:shapetype><v:shape id="_x0000_i1025" type="#_x0000_t75" style='width:674.25pt;  height:513pt'> <v:imagedata src="file:///C:\DOCUME~1\TSUGAN~1\LOCALS~1\Temp\msohtmlclip1\01\clip_image001.png"   o:title="" ></v:imagedata> </v:shape><![endif]--><!--[if !vml]--><IMG height="684" src="https://live.paloaltonetworks.com/" width="899" /><!--[endif]--></SPAN></P><P>Hi,</P><P></P><P>Actually, you *can* use the Service Route setting to route communications to the User-ID Agent.</P><P></P><P>In the Service Route Configuration dialog, make sure that you have selected "Show Destinations" at the lower</P><P>left hand corner of the dialog. You will see a Destination table on the right with IP/FQDN and Source Address mappings.</P><P>At the bottom, there will be a place to add additional mappings.</P><P></P><P>In the "IP Address or FQDN" field, enter the IP address of your system where the User-ID Agent is installed.</P><P></P><P>Then, pull down available interfaces on your device and select the appropriate source IP address.</P><P></P><P><IMG alt="Capture-12-21-00001.jpg" class="jive-image-thumbnail jive-image" onclick="" src="https://live.paloaltonetworks.com/servlet/JiveServlet/downloadImage/1170/Capture-12-21-00001.jpg" width="450" /></P></BODY></HTML> Tue, 22 Dec 2009 00:36:17 GMT https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4927#M3622 migration 2009-12-22T00:36:17Z Re: User Identification Agent with Active Directory https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4928#M3623 <HTML><HEAD></HEAD><BODY><P>Are there any internal downside of using this method to get data for the pan-agent or ts-agent?</P><P></P><P>I mean to "force" route it through the dataplane?</P></BODY></HTML> Fri, 26 Feb 2010 15:30:25 GMT https://live.paloaltonetworks.com/t5/general-topics/user-identification-agent-with-active-directory/m-p/4928#M3623 rps 2010-02-26T15:30:25Z