PA User identification

cancel
Showing results for 
Search instead for 
Did you mean: 

PA User identification

L4 Transporter

How PA decide on user IDs, for example if i have an IP that the user was mapped from UIA, and then a security log in AD map this IP to another user?

or a user that loging with global protect through local DB, and then authenticate to AD, and the PA gets a new mapping from the agent ?

thanks

1 ACCEPTED SOLUTION

Accepted Solutions

L7 Applicator

Pls go through this document  to understand the User-Identification  working functionality : User Identification Tech Note - PAN-OS 4.0

Thanks

View solution in original post

4 REPLIES 4

L7 Applicator

Pls go through this document  to understand the User-Identification  working functionality : User Identification Tech Note - PAN-OS 4.0

Thanks

View solution in original post

L4 Transporter

yes i know how it works but i have a GP user and sometimes the user is changed and sometimes does not

i mean changed from GP to AD, only somtime after a user loging to RDP server, or does the UID service just update the IP-user-mapping regardless the current mapping source?

IP address:  x.x.x.x (vsys1)

User:        domain\user

From:        AD

Idle Timeout: 2692s

Max. TTL:    2689s

Groups that the user belongs to (used in policy)

Group(s):  

admin@PA(active)> show user ip-user-mapping ip x.x.x.x

IP address:  x.x.x.x (vsys1)

User:        domain\user

From:        GP

Idle Timeout: 17889s

Max. TTL:    17889s

Groups that the user belongs to (used in policy)

Group(s):   

So an ip gets identified as being mapped from GP and the very same ip changes the source to AD, is that the issue, please let us know.The ip pool given to your GP users are different from your internal users right?

yes, adn the zone of the GP user is defferent

i have read that the the mapping of the user to ip of a GP user is bind to the connection of the client to the GW, so as soon as the user log in/out the mapping created and removed,

can i remote the UID from the zone or exclude the mapping on the GP pool have someone tried that?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!