ignore users for IP subnet

[OliverGreimers]

Hi,

with the risk that this was already discussed, I have a question regarding ignore users with User-ID.

I configured User-ID for our clients, also for the IT department.
In the IT, we also using admin accounts. So when I started a programm in admin mode, the firewall registered this in the DCs. So my client gets the adm account linked with my client IP.

This is correct but annoying, because our admin accounts have no internet access. So I have to start a normal user login from my client, for example restarting Outlook.

My question is if it's possible to add entries in the ignore list in connection with IP subnets. So I can tell the PA to ignore admin logins for our clients in the IT department.

I did not found any possibility to configure it.

Thanks and best Regards

Oliver

[S.Cantwell]

Howdy Oliver.

I just wanted to acknowledge that I saw the post, but agree that I am not sure there is a way to filter out.

I do know that the FW is capable of not learning based on subnets (dont attempt to learn VoIP softphone subnet, as example), but as for not learning a specific user type.  But you may want to focus in the Group Mapping section of UserID, to see if you can create a certain pattern that will be learned/associated with group mappings, and try to not have the admin accounts part of the pattern.

Then you may be able to do something.  It is a long shot, but wanted to give you some encouragement.  😛

[OliverGreimers]

Hi Steve,

but I'm not sure if this would fit in our environment.

We want to include the admin accounts in the user-id, e.g. for the servers and no internetaccess with the admin accounts on them.

But thanks for your hint, I will have a look at it 😉

Best regards

Oliver

[OtakarKlier]

Hello,

We encountered a similar issue. I you use Exchange for email using Outlook. Have the User-ID agents use it instead of the DC's.

Regards,

[OliverGreimers]

Hi,

I already configured the Exchange servers to poll the user logons.

But in your suggestion, I have to configure only the Exchange servers and delete the DCs in the User-ID Agent configuration, right?

Regards

[OtakarKlier]

Hello,

That is correct, you have to stop monitoring the DC's for it to work as I have described.

Regards,