GP agent as user to ip mapping method for Prisma remote network

[bxbukows]

Is it possible to use GP as user to ip mapping method for Prisma remote network?

I cannot see GP portal/gateway configuration buttons (they are looks not active -greyed out) on Remote Network template (Prisma Access managed by Panorama) this settings is available for Mobile User template. Plan was to integrate internal GP gateway add to the Mobile user template - Portal configuration. Did you have some experiance or knoladge to use GP agent as user to IP mapping method for Remote Network / Prisma?

If I will add this configuration to Mobile user template - to Portal configuration, it will not work for Remote Network because RN-SPN are different firewall than MU-SPN correct?

[reaper]

yes, but:

Since the RN-SPN do not have a GP gateway you can't do it the traditional way with internal host detection.

However, you can look into using ip-user redistribution from the remote peer (if it's a Palo firewall, or via user-id agent) or set up authentication rules/captive portal on the RN-SPN and use GP to authenticate (https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-authentication-policy-with...)

[bxbukows]

Hello, thanks for the answer. What you mean ip-user redistribution. We can configure redistribution from Prisma to the On-Premis fw's or from On-Premis firewlls to Prisma. But how user ip mapping will worked ?

[reaper]

you can set redistribution agents/collectors on (and from) RN-SPNs, so you can actually collect user-id information from the onprem firewall, or Panorama (preferred) so user-id information can be populated

[znazir]

This should work fairly simple unless I missed something, USER ID redistribution can be done from Prisma to on prem
Refer to below doc:
https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-us...

If you need more help on this please elaborate on the use case 

[bxbukows]

Thanks for help, user ip mapping is working for my settings for mobile users, and I did redistribution to the DC and I'm able to see user ip maaping on-prem firewalls. But user ip mapping is not working when device is conneted to the remote network, on the logs I can see just ip addresses on Cortex Data Lake. 

I tried configuration: On RN -> data redistribution added agents our Panorama from DC, Laptop with GP agent (located on RN) should connect to the internal GP gateway from our DC throug internal host detection. But still I'm not sure if this configuration shoud work, because on the RN settings GP portal/gateway are not avaialble. 

[znazir]

In your case if you are trying to redistribute user ip mapping from RN to Prisma Access , 

1. FW on the RN (branch site ) needs to a palo fw to support user-id redistribution.

2. Configure the collector on the RN branch firewall and on prisma access under RN template add the agent configuration.

If the configuration is correct, please validate if the RN(branch firewall) has the user-ip mappings i.e if you see username on logs, if not you need to ensure you have user mapping on the branch office firewall

[bxbukows]

Thank you, I configured user id on branch, group mapping is working and I can see also users from our DC.

To see user id on RN-SPN (inside prisma) I need to perform redistribution, it should be from Panorama or from branch site where is IPSec tunnel to the RN-SPN (Prisma) ?

Can we have few redistributions, or it can cause some issues like loops ?

[znazir]

It should be from the branch site to Prisma Access, however, if you have user-ip mapping being sent to DC or another Palo FW you can redistribute from those devices. It is unlikely there can be a loop or conflict in redistribution when redistributing from a branch site to Prisma Access unless branch sites have similar IP pools.