topic Agentless UserID in a MultiDomain Environment in General Topics

Agentless UserID in a MultiDomain Environment

CHammock — Fri, 10 Jul 2015 13:33:45 GMT

My first question would be is it possible to configure a firewall with no vsys license to query more than one domain without deploying the UserID windows agent?

My second question would be if yes then how given that there is only 1 WMI authentication username, one list of DCs and also that the ignore user list would only apply to a single domain as you don't specify the domain prefix.

Re: Agentless UserID in a MultiDomain Environment

bmorris1 — Tue, 14 Jul 2015 00:11:18 GMT

Hey Chris,

To my knowledge, you will need an agent per domain. The on-board agent can only monitor one domain.

How to configure PAN to identify users on multiple domains

The document specifies that an agent is required for each domain. The on-board agent only counts as one agent.

Hope this helps, and I'll see you soon I bet.

Ben

Re: Agentless UserID in a MultiDomain Environment

CHammock — Wed, 15 Jul 2015 08:10:16 GMT

True but this doc is dated 2011 which would have been before PanOS 4.1 which was when the new UserID agent was released, plus this doc is based on the windows agent and not the onbox agentless agent.