CIE for user/group mapping for firewall on-premise

[RCastro]

Hi Community,

I'm working on implementing user and group mapping for security policies on our on-premises firewall and wanted to verify my understanding of the architecture before proceeding further.

Current Setup:

• On-prem Palo Alto firewall with GlobalProtect configured
• GlobalProtect authentication: SAML via Azure Entra ID (working perfectly)
• Cloud Identity Engine (CIE) tenant configured with directory sync enabled
• Firewall added as a managed device in CIE tenant
• Followed the documentation here: Configure the Cloud Identity Engine as a Mapping Source on the Firewall

What I've Done:

1. Configured CIE as a User-ID source under Device > User Identification > Cloud Identity Engine
2. Enabled directory sync in CIE with Azure Entra ID
3. Users authenticate successfully via GlobalProtect with SAML

My Understanding: Based on my research, here's what should happen:

• GlobalProtect automatically provides IP-to-username mapping when users authenticate via SAML
• CIE (configured as User-ID source) provides the group membership information
• The firewall combines both to apply security policies based on user/group

The Question: The documentation includes a verification step that says: "On the client device, use the browser to access a web page that requires authentication" for testing the mapping.

My understanding is that this browser-based authentication step is just one verification method (typically for Captive Portal scenarios), and that with GlobalProtect + SAML, the user-to-IP mapping should happen automatically when users connect to the VPN. I should be able to verify the mapping simply by running show user ip-user-mapping all after GlobalProtect authentication, without needing any browser-based authentication.

Am I missing something here? Should I expect the mapping to work with just GlobalProtect SAML authentication, or is there an additional configuration step I need to enable browser-based authentication?

Any insights from those who have implemented this architecture would be greatly appreciated!

Thanks in advance!

[TomYoung]

Hi @RCastro ,

You understanding is correct.  GP will provide the user-IP mapping and CIE will provide the user-group mapping.  One additional step that I like to take is to verify the usernames in the group mapping are identical to the usernames in the IP mapping.

> show user group list
> show user group name "<group-name>"

If the usernames don't match exactly, the group mapping will not occur.  Since you are using Azure for both IP and group mapping, the usernames should be identical.

Thanks,

Tom