09-17-2018 07:02 AM
Hello,
We are using certificate-based authentication with Global-Protect in a multi-domain environment without authentication-profiles.
The users are authenticating with smart-cards to Windows and does not have a memorable username witch is why we can't have them typing the username to Global Protect.
We want to be able to controll the user access with an Active Directory-group and mainly tried to add a group to the portal (User/User Group Tab in the agent)
When the users connect, Palo Alto picks up the User-ID without Netbios-name.
That can't be matched with the group-mapping since the netbios-name will automatically populate.
We can't add the domain-name in the Certificate-profile since it is multi-domain. And as I understand it is not possible add serveral domain-names in the certificate profile.
My thought is to remove the netbios-name from group-mapping, but I have not found any way to do this.
Any ideas?
We are running PAN-OS 8.1.3.
Best Regards
xen-pv
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
