Use wildcard in user/group based policy

[AndreaAcampa]

Hi,
We have a Splunk Server that sends to your id-agent (on a windows server) the information of guest users.

Now on PA We can se user@acme.com in the logs, is possbile for us create a rule for all users from acme, without define each user?

So a group policy without LDAP group.

We want to set in the field "source user", something like *@acme.com.

It is possible?

Regards
Andrea Acampa

[bmorris1]

Hi Andrea,

If you're using the syslog method for your user mapping then I believe that you can't use group mapping with this method. If you want to configure group mapping then you'll need to be using a directory service such as Active Directory or eDirectory.

Check the Group Mapping document for more info and how you can enable this in your network.

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/user-id-concepts#33876

A different method would be to enter a source IP range in the source field of your security policy effectively everyone in your internal network uses this rule.

hope this helps,

Ben

[AndreaAcampa]

Thanks.

your reply has been very useful.