topic any solution to keep tracking user IP mapping? in General Topics

any solution to keep tracking user IP mapping?

emr_1 — Tue, 07 Jul 2020 03:14:11 GMT

One of my customer is requesting me to track user IP address when he move from his desk to meeting room, and vice versa.

He carries his laptop, he use same ID account on AD, but his IP address will be changed when he moves around.

I know he needs to generate EVENT LOG on AD to pick up the latest info by UIA, but I have no idea how to...

Does he need always logout and re-logon once he moves?

Any suggestion is welcome.

Regards,

Emr

Re: any solution to keep tracking user IP mapping?

ShaiW — Wed, 08 Jul 2020 14:24:49 GMT

You can use Captive Portal for this. When he opens a web page and is on an unknown IP he will get redirected to a firewall hosted captive portal and asked to authenticate.

Another option:

If your customer can live with a GlobalProtect client software on his laptop - you can configure a GlobalProtect Internal Gateway.

The client software will connect to the internal gateway but without IPsec and because GP is a source of User-ID - this could solve your problem.

Just don't forget to add a PTR DNS record in the internal DNS server - this is 'Internal host detection'.

Shai

Re: any solution to keep tracking user IP mapping?

OtakarKlier — Thu, 09 Jul 2020 21:40:42 GMT

Hello,

Any of the user-id features should accomplish this. We user agents and have it check against Exchange since everyone has it and outlook is always connecting, its a bit quicker we found than monitoring the Domain Controllers.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClRyCAK

You can user one of the other suggestions in the previous reply. They will work as well, Captive portal i would shy away from except in a 'Guest' network environment such as wifi.

Just my thoughts.

Re: any solution to keep tracking user IP mapping?

emr_1 — Fri, 17 Jul 2020 02:26:16 GMT

@ShaiW @OtakarKlier

Thank you for your replies.

CP sounds good solution for my customer, I'll try this.