topic Re: Can I enforce security based in AD Computer groups yet? in General Topics

Can I enforce security based in AD Computer groups yet?

JWileyR — Tue, 07 Mar 2017 01:54:25 GMT

I see history here indicating the user-id agent has been blind to computer names when the group membership is added to user IDs. The CLI DOES show the computer name as a userID (with a post-pended $) and the groups are mapped correctly to the computer group I created and dumped the computer in.

On the other hand the USER signed into that computer does not show the computer group as one of their member groups.

It looks like the base data is in the firewall but I can't get traffic or security policies to recognize the traffic from the computer name, only the AD user name.

Is there some way I can introduce computer names and/or computer groups into user-id based enforcement? My goal is to create a few policies based on AD computer group. Maybe custom AD groups in the Group Mappings Settings?

Re: Can I enforce security based in AD Computer groups yet?

Brandon_Wertz — Tue, 07 Mar 2017 15:37:13 GMT

At my company we make use of EDLs to accomplish.

We built a script which scrubs the AD groups we want. We then bump that script againts DNS. That DNS output is dumped into a text file on our internal network which is hosted behind IIS. We then target the Palo to that .txt file and leverage that object in the firewall for security policy controls.

This process is cumbersome for sure, but works for us.

Re: Can I enforce security based in AD Computer groups yet?

JWileyR — Wed, 08 Mar 2017 02:08:14 GMT

Brandon, thanks for the reply. I'm guessing that the pain you go through to harvest this data is a result of not having a palo-alto supported solution to this? Does anyone else have alternatives? Something in PANOS 8 maybe?

Re: Can I enforce security based in AD Computer groups yet?

Brandon_Wertz — Wed, 08 Mar 2017 14:46:22 GMT

Correct as of 7.1 and lower. There's no way I know of to enumerate computer groups and apply them to a "source" or "dest" for security policy.