pass on user-id information

[mr.linus]

Hi All,

Setup

- We got 2 PA clusters with a leased line between them, joining two offices of the same company.

- Both offices have their own AD, servers, ...

- We have GlobalProtect configured on both devices.

- We have PanOS User-Id configured (so no agent) on both devices

- We have a user based security rule providing a "support" user access to certain devices.

=> This is all working fine, but only if we use each offices his local GlobalProtect connection. In other words, we can only reach servers in office A if we login to the GlobalProtect of office A.

Goal

- We now want to be able to GlobalProtect to office A, but reach servers on office B, with user restriction (this last part is the important part).

Problem

- When we create a rule on the PA of office B, to allow access from connection coming from office A to certain servers, the PA of office B does not know the user since it was authenticated via GlobalProtect on the PA of office A. Hence, we can not create user based security rules.

Solution?

- Either give the GlobalProtect "support" user a fixed IP (that way we can work IP based instead of user based). But this is not possible I think, only by creating a separate portal + gateway?

- Passing on the user-ip mapping from office A to office B. But we only want the user-ip info of the GlobalProtect users (which are local users: same user exist on both devices). Is this possible, and if yes, how do we configure this?

Kind regards

[mr.linus]

I got it to work by:

- adding a Pan Agent with ip = mgmt ip of the other PA (on port 5007)

- enabling user-id under the management interface settings (device/setup)

- enable user-id identification on the zones connecting the two PAs

=> but we still only want to exchange the GP users, not all users. Is that possible?

[UhMayYeah · Accepted solution]

Hello ,

At this moment ,feature to allow redistribution of GP user-ip mappings, is not available.

Please consult your SE to discuss the option of filing a feature request.

[UhMayYeah]

Just to be clear, with OS-5.0 you may use to the User-ID collector feature to pass on User-IP mappings (Captive Portal, GP mappings) from firewall A to B (User ID collector OS-5.0) firewall.

But the option to selectively pass only GP User-IP mappings is not available.

Ref How to Configure and Verify User-ID Collector in PAN-OS 5.0