User-ID

[jdprovine]

When enabling user-id where does it check against to get the information to identify  the users? I have it turned on for serveral zones and it only seems to work on the VPN user-id's.

[jdprovine]

@OtakarKlier

Yes it is enabled on the zones but apparently I don't have everything it needs set up because its still not working. I can see how that would be annoying LOL 😉

[jdprovine]

I see that there is a userid agent method and a clientless userid method. What are people using the most? I know that the clientless method will cause more load on my firewall but i am not sure how to gage how much it will add. Also we do mostly LDAP on a unbuntu box all I saw was what looked like one compatible with active directory and window

[jdprovine]

@Mick_Ball

I have read over this a couple times and this is no small udertaking, we have a mix of authentication methods active directory, ad-ldap, open ldap and radius. I may try puttin the agent on the AD domain controller and see how much info I get from that. Unfortunately alot of the users are not a part of our domain since they are college student and connect using their own devices

[BPry]

@jdprovine,

Do you seperate your students into a 'student' VLAN? It's possible to simply include IP ranges that you would actually expect to see the user-id information, and you could simply ignore your student BYOD devices. 

[jdprovine]

@BPry

Yes we do separate them into their own vlans as well as a separate zone on the PA.  A majority of our students use wireless for everything and we authenticate against radius to let them on the wireless(we have more than one wireless). Is it possible to get userid information from Radius? 

[reaper]

@jdprovine you can configure the RADIUS server to forward succesfull authentication messages as syslog to a syslog receiver (both firewall and UserID Agent can do this)

[BPry]

@jdprovine,

You can do syslog forwarding or you could use RadiUID. Syslog forwarding is probably going to be the easiest solution however. 

[Mick_Ball]

Ok i have got to jump in here as getting very interesting....

im puzzled by the syslog stuff. Assumimg rad auth is accepted and a tick in the box to syslog... how does this then relate to user ip mapping... or is this for group membership ?

just to add... we also use radius for non staff logins on GP. We have no user agent to assist with this. The palo seems to do this itsel when user id is enabled on interface/zone.

a user logs into radius as fred, we have a policy that allows fred through... 

am i missing something .......

[jdprovine]

@reaper

The userid agent I would install on an AD domain controller could also pull information from another server that the radius information forwarded to a syslog server or the firwall can be set up to access the syslog servers information for radius - interesting.

Does the userid agent have to be on all your domain controllers or just one?

[jdprovine]

@Mick_Ball

I can see all the users from my GP logins too, I think its because they are authenticated through the portal but I don't think that is same userid stuff

[Mick_Ball]

@jdprovine

Regarding previous post... it depends on AD server replication.....

i assume you have more than 1 DC so i would have at least 2 agents running and point PA to both of them. You should in my opinion also point each agent to all DC’s. The agent comes with an autodiscover option.

[Mick_Ball]

Correct, its not using the agent but it still maps an ip to a user and works just as well as the agent when it passes a policy.

however... the downside to this is that this user will only be mapped local, so using the agent will propogate the info to all devices.

anyhows... im hoping @BPry and @reaper can advise further as i only use the agent for AD and never fully understood the syslog stuff....

[jdprovine]

@Mick_Ball

We have to AD domain controllers - probably be best to put and userid agent on each one - couldn't hurt LOL

[reaper]

The agent only needs to be on one server (not even the AD), but more is better (redundancy, less network traffic if remote sources get "read")

Syslog needs to be sent TO the agent or the firewall, they don't go and access logs remotely

[BPry]

@Mick_Ball,

You should be getting he user-id for your GP stuff; the firewall can read that directly when it passes the auth attempt.