Apple clients and user-id mapping

Reply
Highlighted
L2 Linker

Apple clients and user-id mapping

Hello All,


We recently installed two 3020s in active-passive and connected them to our LDAP.  We see some users are mapping, but not all.

Is there a way for unknown users to authenticate to the Palo Alto so they are given the correct policy?  This was a very simple procedure in our previous Lightspeed filter.

A local user agent would be ideal!

Thanks!

Grubbsy

Highlighted
L4 Transporter

Re: Apple clients and user-id mapping

Hi,

You should use GlobalProtect client (installed on workstations) to ID users on your network. You should look for documents talking about Global Protect and internal gateways.

Highlighted
L2 Linker

Re: Apple clients and user-id mapping

Don't you need a license for Global Protect to use the client?

Highlighted
L3 Networker

Re: Apple clients and user-id mapping

Hi,

are the userID agents connected to every DC or do you only have one? It could be possible that some user are authenticated on a DC which is not monitored from your userID agents. If the users are not mapped and userID is activated for the zone the agents will try to resolve the user with WMI requests. If this doesn't work you can activate captive portal so every connection with an unkown user will have to authenticate through captive portal.

If you want to use the Gobal Protect Client it's free if you only use one portal and external gateway.

Highlighted
L4 Transporter

Re: Apple clients and user-id mapping

You won't need a licence for your use. Global PRotect client is best way when you are running Macs on your network.

PAN can help you configure these through Professional Services consulting

Highlighted
L7 Applicator

Re: Apple clients and user-id mapping

If you don't want to install Global Protect, you could configure captive portal to kick in for unknown users.

Overview and procedure:

Captive Portal Operation in PAN-OS 4.0

Minor updates in PAN-OS 5:

How to Configure Captive Portal

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!