topic Re: User-id doesn't work on SSID in General Topics

User-id doesn't work on SSID

SThatipelly — Fri, 02 Aug 2019 19:06:18 GMT

I have PAN UID agent mapping IP-to-usernames. It works like a gem for internal users but not on the DMZ which allows company phones with their AD creds. I am not seeing any usernames for these users although they authenticate against AD server. has anyone experienced this before? Please provide me your inputs.

TIA

Re: User-id doesn't work on SSID

OtakarKlier — Fri, 02 Aug 2019 20:36:29 GMT

Hello,

Have you enabled User-ID on that zone?

Regards,

Re: User-id doesn't work on SSID

SThatipelly — Fri, 02 Aug 2019 20:40:58 GMT

yes.

Re: User-id doesn't work on SSID

OtakarKlier — Fri, 02 Aug 2019 21:04:03 GMT

Hello,

Does the User-ID agent look at the authentication source for the mapping?

Regards,

Re: User-id doesn't work on SSID

BPry — Mon, 05 Aug 2019 02:34:31 GMT

@SThatipelly,

How exactly are you authroizing those users on the controller, through RADIUS? That won't show up if you are using standard AD event log reading by default.

Re: User-id doesn't work on SSID

SThatipelly — Mon, 05 Aug 2019 12:34:43 GMT

we are authenticating against AD. Yes, Firewall is pointing to that AD server.

Re: User-id doesn't work on SSID

Brandon_Wertz — Mon, 05 Aug 2019 14:23:46 GMT

I'd be careful with user-id in your DMZ zone. If you have rules that allow too much access you could potentially be exposing your user IDs to the public.

https://www.theregister.co.uk/2014/10/21/palo_alto_customers_spray_net_with_firewall_creds/

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXHCA0

Re: User-id doesn't work on SSID

SThatipelly — Mon, 05 Aug 2019 14:30:56 GMT

@Brandon_Wertz yes, I do have wmi probing disabled. this is a trusted devices dmz.