topic Re: Use wildcard in user/group based policy in General Topics

Use wildcard in user/group based policy

AndreaAcampa — Thu, 26 Jan 2017 10:46:59 GMT

Hi,
We have a Splunk Server that sends to your id-agent (on a windows server) the information of guest users.

Now on PA We can se user@acme.com in the logs, is possbile for us create a rule for all users from acme, without define each user?

So a group policy without LDAP group.

We want to set in the field "source user", something like *@acme.com.

It is possible?

Regards
Andrea Acampa

Re: Use wildcard in user/group based policy

bmorris1 — Thu, 26 Jan 2017 11:47:18 GMT

Hi Andrea,

If you're using the syslog method for your user mapping then I believe that you can't use group mapping with this method. If you want to configure group mapping then you'll need to be using a directory service such as Active Directory or eDirectory.

Check the Group Mapping document for more info and how you can enable this in your network.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/user-id-concepts#33876

A different method would be to enter a source IP range in the source field of your security policy effectively everyone in your internal network uses this rule.

hope this helps,

Ben

Re: Use wildcard in user/group based policy

AndreaAcampa — Thu, 26 Jan 2017 15:49:59 GMT

Thanks.

your reply has been very useful.