topic UserID in General Topics

UserID

CARRIERJerome — Wed, 27 Mar 2019 06:43:11 GMT

Hello

Is Userd Identification feature works only whith Active Directory users account or also with Computers accounts ? I would like to create a security rule who allow access on our internal ressources only for computer with an active computer account in our AD and for computer without an valid computer account or disable account, the traffic must be blocked.

Re: UserID

Brandon_Wertz — Wed, 27 Mar 2019 17:26:22 GMT

You cannot use host level information to enforce security policy. (ie computer group membership, or lack there of)

Re: UserID

BPry — Thu, 28 Mar 2019 21:09:53 GMT

@CARRIERJerome,

You could build something like this with a dynamic group, address objects, and the XML API fairly easily that you could update on a scheduled basis. However, as @Brandon_Wertz says this isn't something natively supported by the firewall.

Re: UserID

Brandon_Wertz — Thu, 28 Mar 2019 21:25:01 GMT

@BPry wrote:
@CARRIERJerome,
You could build something like this with a dynamic group, address objects, and the XMLAPII fairly easily that you could update on a scheduled basis. However, as @Brandon_Wertz says this isn't somethingnativelyy supported by the firewall.

Yeah there's definitely "a way" to do it, but it's not native feature set. I actually had this requirement about 5 years back and got it implemented at my company using an EDL or back then it was a "dynamic block list."

If you query the computer AD security group via a script, dump that script to a file, then perform an NSLOOKUP of those hostnames dump that IP address into another file. This file which has the IP addresses can be used in the EDL on Palo.