PAN AGENT WITH MULTI-FOREST

[alle]

Hello,

I have Two FOREST A and B, I have a trust relation between this two forest.

When I add a user of the forest A in the group (local) of the forest B I can't see in the pan agent the users.

Any Idea to see the user of the forest A in the group of the forest B?

regards,

[ST1985]

Update to my post below:

Since I only had 3 users from a remote forest to worry about I was successful by adding their remotedomain\username logon IDs to the SourceUser list in one of our policies. It seems that although the agent won't expand the groups, the FireWall is quite happy when you explicitly list user's names in the policy.

----------------------------

I was trying to make this work just this morning also - same result. Users from another domain are not seen although their names do appear on the Monitor page next to their blocked packets.

I think the answer to y/our question is posted here:

https://live.paloaltonetworks.com/message/1819#1819

I guess we'll have to create a separate policy and filter based on PC names rather than user names. It won't be pretty though.

PaloAlto - why is it hard to expand Domain Local group membership?

[alle]

Hi Skytrain,

I have seen that is not possible to use multiforest with the PAN-AGENT 3.1.2. So I do an update of PANOS in 4.1.6

and an update pan-agent (user-id-agent) 4.1.4.

Moreover you must use the FIREWALL for enumeration and not the user-id-agent because you must use the global catalogue to see the

forest.

I v seen to that the group must be an Universal Group.

I do an another test but without success for the moment!

regards,

[mikand]

I think you can select ldap-proxy when you setup your userid connection to make the firewall query the ldap through your userid agent (as before) instead of having to do ldap on its own (regarding flows in your network).

[alle]

Hello mikand,

it's true that you can use the option ldap-proxy. but if you want browse the global catalogue (port 3268) and not LDAP

(port 389) you must use the firewall ldap server configuration. the global is usefull when you have severals domains.

And when I do a test with two different forest with trusted domain the enumeration doesn't work( I see just the main domain). Maybe it's only possible with severals domain in the same forest?

[essnet]

unfortunalty , using global catalog will append wonrg domains in front of users.

Imagine ou have 1 forest with 2 domains : America, Europe. You configure PaloAlto LDAP with base domain mycompany.group and domain mycompany.

Users will be listed as:

• mycompany\joe
• mycompany\roger

while real users are:

• america\joe
• europe\roger

This is also breaking user / group mapping for me.

So for the moment I am using 1 LDAP setting per domain + 1 Group mapping per Domain. This is annoying but I hope PA will improve that anytime soon.

[alle]

Hi essnet,

it is possible to use mutlidomain in the same forest with the global catalogue. you must just modify the xml configurationof your user-id agent. You can modify in the xml file the name of domain to send at the firewall so even if you do a ip-mapping in the America domain you can send to the firewall my company.

USER AGENT    ip-mapping                           ->    FIREWALL  IP-MAPPING

AMERICA/JOHN 192.168.1.2                                   MYCOMPANY/JOHN 192.168.1.2

regards,

[essnet]

Ok, but what about Europe domain users ?

I think you don't get it , I want to keep local domains, but PA uses global name. In addition it breaks AD groups feature.

[alle]

essnet,

you can do the same thing on EUROPE with the modification of xml file

USER AGENT    ip-mapping                                               ->    FIREWALL  IP-MAPPING

EUROPE/NICO 192.168.1.2                                                              MYCOMPANY/NICO 192.168.1.2

And for  your group you must use Universal GROUP!

but it's true that you can just use the domain of your enumeration ( MYCOMPANY)

Alex

[essnet]

Ok well I am doomed,

I have same duplicate users in some forests and domains :

europe\bob , asia\bob and america\bob ... which of course aren't same people ....

[alle]

In this case it's true you can't use this solution, you must keep one agent per domain.

But with this configuration it's not possible to create policy with  a GROUP which contain EUROPE and AMERICA'S USERS.

you must autorized a group of EUROPE and a group of AMERICA.

BUT I'VE A GOOD HOPE IN THE NEW VERSION 5.0

[alle]

SO FOR CLOSE THE DISCUSSION :

IS NOT POSSIBLE TO USE PAN-AGENT WITH MULTI-FOREST ( PAlo-alto confirmation)

[nthen]

Do you know were to set the domain under the XML file?  Do I change the DNSDomain option or something else?