Curious: How are people doing User-ID?

[MRosloniec]

Hey All -

I am just curious to find out how people are doing User-ID?  We are currently using the software Agents connected to DC's, and we read syslog from our Wireless Controllers to parse user to IP mappings for wireless.  Our wireless solution is only about 50% accurate due to the fact that many times logs are written to the wireless controller before the DHCP process completes, so we see a log that contains a User ID but an IP of 0.0.0.0.

How are others doing user-ID?  We have a global environment and don't really have one central place for User-ID.. that being said we have a couple servers here in the US with software agents on them, 2 in AsiaPac, and 2 in Europe.  Wondering what other people are doing to help with accurate user-id?

Thanks!

[kadak]

Hello matt.rosloniec@amway.com,

This document will get you started:

User-ID Best Practices - PAN-OS 5.0, 6.0

Hope that helps!

Thanks and regards,

Kunal Adak

[pulukas]

If your wireless solution is Aruba check with your sales engineer.  They now have the ability to connect directly from the controllers to PA user-id.

[ialeksov]

Try using WMI probing as one of the most correct methods, but bear in mind to limit the scope of probing to the local network, because you probably dont want to send wmi probes from usa to europe for each unknown user.

Also one other thing you can do is to include the exchange in the monitored servers.

As far as it goes for aruba, check these docs which show you how to get the logs directly to the syslog receiver that can be run on the PA or on the user-id server:

-How to Collect the User-IP Mappings from a Syslog Sender Using an User-ID Agent

-How to Configure a Custom Syslog Sender and Test User Mappings