Block Category based on local group

[nbctcp]

INFO:
-Palo 3320 PanOS 8

GOALS:

I have list of users and groups in local palo database
I want to block SALES group to access porn sites but allow DIRECTOR group

QUESTIONS:

1. should I use subinterface

2. since director mac address can't be seen if using L3 switch then should I

a. use dynamic vlan mean wherever director go, he must authenticate and get the same vlan

b. is there a palo client software that will automatically tell palo that this pc belong to paloalto local user director1

tq

[BPry · Accepted solution]

@nbctcp,

Is Captive Portal or GlobalProtect not an option within your environment? That would be my 'prefered' way of doing user identification if you aren't utilizing anything sort of AD. 

[OtakarKlier]

I agree with @BPry , use URL filtering and AD groups for this. I do it all the time.