radius user group

[alessandroco]

Hello!

I'm studying the PCNSA, may I ask you a question about a security policy?

The "it" group in that policy could be a Radius group imported on the FW?

Or could be a way to map users to group?

PS:

it would be very useful if Palo Alto offered a free VM lab to test which we are learning, anyone know if it's already been provided?

Many thanks

Ale

[aleksandar.astardzhiev]

Hi @alessandroco ,

There are two ways to use users and user groups in policy:

- Local database: You can create the users (username and password) localy on firewall and then create user group again localy. After that in your security rule you can refer indivituals local users or the local user group. Local users and groups are configured under Device -> Local Users Database

- Group Mapping: Unfortunately currently only LDAP is supported. So if you have Active Directory, firewall will use LDAP to query the AD and "extract" all user groups that you have already created at the AD (you can set some filters and limit the groups that firewall will query, but by default FW will try to collect them all).

So to anwert your question - No, user groups information cannot be collected over RADIUS. You need LDAP to gather group membership information (which user is member of which group).

[alessandroco]

Hello! Thank you very much for your answer, now is more clear to me!

Bwt I still need a clarification, in fact the question said: “what is the
purpose of the group in the security policy rule?

1)map username to groups
2)that group is a radius group

Which one do you suggest?

Thank you very much!