User identification in security policy

Reply
Highlighted
L1 Bithead

User identification in security policy

Hello,

 

I have a problem with configuration of user identification in security policy. What is the target: for some users who login to VPN via GlobalProtect I would like to limit them to some specific subnet. Users login to VPN using their Active Directory accounts (via Radius). I created LDAP profile, group mapping and security policy (with source group). I also in AD created some groups and added users to them. When I check on CLI: show user group name GROUP-NAME I see users belongs to the group but when I login via GP I don't have access to resources permited in policy. Where can be the problem?

Thank you for any help.

Regards


Accepted Solutions
Highlighted
L3 Networker

what you see in traffic log is the User-ID detected from GP login and not same as "Omintech\asmolarek".

enable User-ID agent, from "Device-->UserIdentification" with the crossponding login-information and make sure you select "Allow Matching username without domains"

after that the traffic should be matched by the secrutiy Policy

Good luck.

View solution in original post


All Replies
Highlighted
Community Team Member

Hi @ArkadiuszSmolarek ,

 

I would be helpful to know how the firewall is identifying the traffic/session. 

 

Is the traffic being denied by your general deny rule ? Can you check the session info (userinfo/zones/destinations/etc ...) and verify if everything is matching according to the rule you've configured ?

 

Cheers,

-Kiwi.

 
Highlighted
L1 Bithead

Hi,

Yes, the traffic that should be identified by created by me security rule is hit by default deny rule.

The rule created by me have 0 hits.

Regards

Highlighted
L3 Networker

I would check the Firewall Traffic Logs, and look for the IP of GP-User and see if user-ID has been correctly identified. 

check User-ID Logs too

Highlighted
L1 Bithead

In the traffic log and User-ID log I see correct user identification:

Traffic-log.JPGUser-ID-log.JPG

Highlighted
L3 Networker

can you also share your security Policy pls.

Highlighted
L1 Bithead

Sec-pol.JPGCLI map.JPG

Highlighted
L3 Networker

what you see in traffic log is the User-ID detected from GP login and not same as "Omintech\asmolarek".

enable User-ID agent, from "Device-->UserIdentification" with the crossponding login-information and make sure you select "Allow Matching username without domains"

after that the traffic should be matched by the secrutiy Policy

Good luck.

View solution in original post

Highlighted
L1 Bithead

Thanks, it works

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!