- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
08-02-2015 04:45 PM
Hi All,
Is there a way in PanOS 6.1.x to manually map a user-id to an ip-address.
Or is there a way to set an IP-address to be exempt from the user-id mapping policy.
I have PA-500s being staged behind a generic firewall inside a production network with a PA-3000 on the perimeter. The PA-500s NAT their external connections via the generic firewall and cannot establish connection to the PA update server without connecting a laptop behind the generic fw and authenticating via the captive portal.
Regards,
Charles
08-05-2015 12:40 PM
Or you can also add an exception policy for your PA500 ip address in the top of captive portal policies. Just need to configure action as "no-captive-portal"
from: PA500_IP -Trust
To: any -Untrust
Actions: no-captive-portal
you cand test the policy using the following command
test cp-policy-match from <value>|<any> to <value>|<any> source <ip/netmask> destination <ip/netmask>
Regards,
G
08-02-2015 05:13 PM
On the bottom of the User-ID setup screen you can enter exclude addresses that will be ignored for user-ID.
08-02-2015 10:55 PM
Thanks Steven. Just to confirm that if I follow this route, then I would need to explicitly define all networks to be user-id'd under the include action.
08-03-2015 03:51 AM
Yes, once you setup this section it is comprehensive on both exclude and include networks.
08-05-2015 12:40 PM
Or you can also add an exception policy for your PA500 ip address in the top of captive portal policies. Just need to configure action as "no-captive-portal"
from: PA500_IP -Trust
To: any -Untrust
Actions: no-captive-portal
you cand test the policy using the following command
test cp-policy-match from <value>|<any> to <value>|<any> source <ip/netmask> destination <ip/netmask>
Regards,
G
08-05-2015 12:42 PM
Keep in mind that the Agents process the include / exclude networks list in a top-down fashion just like the firewalls do policy. What I did to keep from having to manually identify all of the networks I wanted to include, is I put all of my excludes at the top and then created 3 include entries to cover all of the RFC1918 addresses.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!