User-ID mapping integration for Multi-Domain AD server

[tamilvanan]

Hi All,

We are using windows based User-ID agent on Palo alto firewall for user-id mapping.

We have an existing setup with AD domain abc.com for which the User-ID mapping is implemented on PA Firewall and User ID agent is installed on the abc.com domain controller and it is working fine without any issues.

Now we are creating an completely new set of domain xyz.com with dedicated AD Server. We are able to implement group mapping for xyz.com domain on firewall.

Now we are planning to install User-ID agent on the xyz.com domain controller also and trying to configure Agent based User-ID mapping for the same.

I had came across some articles which explains User-ID mapping on Palo Alto firewall cannot be implemented for two completely different domains.

Thanks in advance!!

[ShaiW]

Hi

I have done this a few weeks ago. The firewall itself can connect directly ('integrated User ID') to AD servers but this can only be done for 1 domain and maybe that is what you read in articles. The second domain must use User-ID Agent installed on a member server of that domain. There is no problem with the first domain also using User-ID Agent instead of the integrated method.

You need to have 2 LDAP profiles, and 2 Group Mapping profiles - 1 for each domain.

The User-ID Agent will send IP-to-User mapping for it's domain and if you type 'show user ip-user-mapping all' you should be able to see usernames from 2 domains, such as 'microsoft\username1' & 'contoso\username2'.

Hope this helps,

Shai