PAN-Agent Multi Domain and Group membership

u2343 — Fri, 12 Mar 2010 12:48:14 GMT

Hi,

We have a forest domain with 2 child domains. Now I have 2 pan agents installed for both domains and it's working well.

Now I have the following problem about wich groups to use.

I must use 2 global groups to give users access through the firewall. A global Group from domain A and a Global Group from Domain B. So this means I must administer 2 groups in different domains.

Normally in AD when you use a Domain Local group then you can put users from different domains in this group.

I have done that so I have a Domain Local Group with users from Domain A and B and selected this group in the Policy but no success.

Is it possible to use a domain Local group witch the User-ID feature?

The wish is to administer 1 group instead of 2 groups from both domains.

Many Thanks

Osman Bor

Re: PAN-Agent Multi Domain and Group membership

swhyte — Tue, 16 Mar 2010 18:06:14 GMT

Hello Osman,

we may read the users in the domain local group, but we will not create a user to ip mapping for the names that are not part of the domain that the pan agent is configured for.

So using the domain local group with not work as a work around for this.

topic PAN-Agent Multi Domain and Group membership in General Topics

PAN-Agent Multi Domain and Group membership

Re: PAN-Agent Multi Domain and Group membership