topic Re: Can we create a user group incluing another set of mapped user group from AD? in General Topics

Can we create a user group incluing another set of mapped user group from AD?

Udana — Thu, 03 Jun 2021 10:06:02 GMT

Hi All,

We have a challenge such that, there are around 100 mapped user groups from AD and we need to add them in a single rule. Is there any way we could add those user groups to another single user group and use it in the rule?

Thanks!

Re: Can we create a user group incluing another set of mapped user group from AD?

Remo — Thu, 03 Jun 2021 11:59:38 GMT

Hi @Udana

You could create a custom group with which you can create a group based on an ldap filter. With this ldap filter you can create a filter with the member-of attribute to include your other groups and then use this one custom group in the security policy.

Re: Can we create a user group incluing another set of mapped user group from AD?

Remo — Thu, 03 Jun 2021 12:08:11 GMT

... or you create a group in active directory where you add these 100 groups to it and in the security policy rule you will then be able to use this active directory group.

Re: Can we create a user group incluing another set of mapped user group from AD?

OtakarKlier — Thu, 03 Jun 2021 16:58:42 GMT

Hello,

This is what Remo was referring to, I think:

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000ClTp

I would recommend staying away from embedding groups as I have seen this cause issues in the past with various products.

Regards,

Re: Can we create a user group incluing another set of mapped user group from AD?

Udana — Fri, 04 Jun 2021 11:59:18 GMT

Hi All,

Thanks for the responses. Assume that we have a ldap group as CN=x,OU=Groups,OU=y,DC=abc,DC=com . In this case, can we filter out groups from OU level? I'm not clear about how to create the filter in that custom groups. I really appreciate if you could help me out here.

Thank you!

Re: Can we create a user group incluing another set of mapped user group from AD?

Remo — Fri, 04 Jun 2021 15:27:32 GMT

Hi @Udana

As far as I know, you cannot create an ldap filter that gets all groups in a specific OU. For such a query you need to use the base DN in an ldap server profile. So in this case I recommend to create a new ldap server profile (or copy the existing one) and specify the base DN exactly as you need it to get the groups you need.