topic Re: User-ID Mapping To Not-Domain-Joint Devices in General Topics

User-ID Mapping To Not-Domain-Joint Devices

Sadik_Khirbash — Tue, 03 Oct 2017 23:53:49 GMT

Hello,

What would be the best way to enable User-ID for devices that aren't joined to the domain? We have a number of contractors whose laptops aren't members of the domain but we would like to enable User-ID to be able to monitor their User-IDs?

Thanks in advance.

Best, ~zK

Re: User-ID Mapping To Not-Domain-Joint Devices

Raido_Rattameister — Wed, 04 Oct 2017 00:58:25 GMT

If you have Exchange and they have Outlook connected to it then you could configure Palo to read Exchange event log.

You could also install GlobalProtect client into contractor laptops to get UserID. This can be used just for UserID without encrypting traffic if they are inside your organization.

Or you could use Caprive Portal (like hotels and airports) to ask user to enter credentials you have provided to them to get IP to User mapping. Captive Portal capability is built into Palo.

Re: User-ID Mapping To Not-Domain-Joint Devices

Sadik_Khirbash — Wed, 04 Oct 2017 16:12:06 GMT

Thanks for the reply. We're on O365 so I don't think monitoring the Event log in Exchange would be an option. I am leaning towards using GP, which we currently use to access the corp's network from the outside. Do you have any information on how to configure GP for the users/contractors in the inside(LAN)?

Thanks, ~zK