topic Re: UserID information in General Topics

UserID information

jdprovine — Wed, 07 Nov 2018 14:43:29 GMT

Is there a way to pull the UserID information from the Palo alto logs concerning VPN users?

Re: UserID information

Mick_Ball — Wed, 07 Nov 2018 15:11:34 GMT

User ID is out there

running freely across the wind

turning,churning,yearning,learning..

sorry wrong post... ha ha..

Hi @jdprovine

have you enabled "User Identification" on the VPN zone or have i missed your point...

Re: UserID information

jdprovine — Wed, 07 Nov 2018 15:31:06 GMT

@Mick_Ball

Yes userid is enabled on the VPN but some one else needs the information for another program that manages accounts

Re: UserID information

Mick_Ball — Wed, 07 Nov 2018 15:35:49 GMT

do they need traffic logs or connection logs...

if you filter traffic logs "from zone" = (your vpn zone) do you see the source users...

Re: UserID information

BPry — Wed, 07 Nov 2018 17:11:04 GMT

@jdprovine,

The command 'show user user-ids all' will display the active user-id mappings for the firewall, however will not be limited specifically to your VPN users. The command 'show global-protect-gateway current-user' and 'show global-protect-gateway previous-user' will display any users who reciently connected. All of these can be grabbed from the API.

Hopfully that includes the information that they are looking for.

Re: UserID information

jdprovine — Wed, 07 Nov 2018 17:44:56 GMT

@BPry

So that would allow the user administrator to pull the VPN userid information from the PA into another program he has

Re: UserID information

BPry — Wed, 07 Nov 2018 20:08:27 GMT

@jdprovine,

If you generated the API call and captured the results it really depends on the program that he's using if it will accept the firewalls output. My guess would be that it would be capable of doing so, but can't be sure.

Re: UserID information

jdprovine — Thu, 08 Nov 2018 16:12:37 GMT

@BPry

I think it may be a home grown program unfortunately I don't know I will see if I can find out

Re: UserID information

BPry — Thu, 08 Nov 2018 17:22:04 GMT

@jdprovine,

That would actually be better; if it's something home grown they should be able to build a way to accept the XML output from the firewall easily enough.