topic Re: User-ID and internet access in General Topics

User-ID and internet access

Farzana — Fri, 16 Sep 2016 06:46:00 GMT

Hello,

If a user uses the PC at home (not behind the Palos) to access the Internet then hibernates their PC, then comes to work and connects to the network (behind the Palos) and un-hibernates, they can no longer access the Internet until the PC re-authenticates to AD and when the user-ID agent can identify the user again. There is a period when the user cannot use the Internet as the Palo policy states the user must be known via user-ID. This can be while depending on what apps the user uses after they un-hibernate.

Is there a way to fix this?

Thanks in advance

Re: User-ID and internet access

bmorris1 — Fri, 16 Sep 2016 10:44:43 GMT

Hi Farzana,

You could deploy Global Protect & internal host detection so that when the computer comes out of hibernation, the GP connects and authenticates the user that way (but does not establish a tunnel).

Another way would be to implement a 'catch-all' captive portal policy so that if all the other identification methods fail, they have to authenticate via a captive portal.

One other way would be to configure wireless access points to send syslog to your firewall, if a user authenticates to the wireless network the AP could send syslog to the firewall containing the username & IP address which you can configure the firewall to parse out and create a mapping for them.

You can find more info here and determine which solution best fits you.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/user-id-overview#67469

hope this helps,

Ben

Re: User-ID and internet access

Farzana — Mon, 19 Sep 2016 00:21:53 GMT

Thanks Ben for the wonderful suggestions.