GP agent as user to ip mapping method for Prisma remote network

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

GP agent as user to ip mapping method for Prisma remote network

L1 Bithead

Is it possible to use GP as user to ip mapping method for Prisma remote network?

I cannot see GP portal/gateway configuration buttons (they are looks not active -greyed out) on Remote Network template (Prisma Access managed by Panorama) this settings is available for Mobile User template. Plan was to integrate internal GP gateway add to the Mobile user template - Portal configuration. Did you have some experiance or knoladge to use GP agent as user to IP mapping method for Remote Network / Prisma?

If I will add this configuration to Mobile user template - to Portal configuration, it will not work for Remote Network because RN-SPN are different firewall than MU-SPN correct?

8 REPLIES 8

Cyber Elite
Cyber Elite

yes, but:

Since the RN-SPN do not have a GP gateway you can't do it the traditional way with internal host detection.

However, you can look into using ip-user redistribution from the remote peer (if it's a Palo firewall, or via user-id agent) or set up authentication rules/captive portal on the RN-SPN and use GP to authenticate (https://live.paloaltonetworks.com/t5/globalprotect-articles/globalprotect-authentication-policy-with...)

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hello, thanks for the answer. What you mean ip-user redistribution. We can configure redistribution from Prisma to the On-Premis fw's or from On-Premis firewlls to Prisma. But how user ip mapping will worked ?

Cyber Elite
Cyber Elite

you can set redistribution agents/collectors on (and from) RN-SPNs, so you can actually collect user-id information from the onprem firewall, or Panorama (preferred) so user-id information can be populated

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L2 Linker

This should work fairly simple unless I missed something, USER ID redistribution can be done from Prisma to on prem
Refer to below doc:
https://docs.paloaltonetworks.com/prisma/prisma-access/3-2/prisma-access-panorama-admin/configure-us...


If you need more help on this please elaborate on the use case 

L1 Bithead

Thanks for help, user ip mapping is working for my settings for mobile users, and I did redistribution to the DC and I'm able to see user ip maaping on-prem firewalls. But user ip mapping is not working when device is conneted to the remote network, on the logs I can see just ip addresses on Cortex Data Lake. 

I tried configuration: On RN -> data redistribution added agents our Panorama from DC, Laptop with GP agent (located on RN) should connect to the internal GP gateway from our DC throug internal host detection. But still I'm not sure if this configuration shoud work, because on the RN settings GP portal/gateway are not avaialble. 

In your case if you are trying to redistribute user ip mapping from RN to Prisma Access , 

1. FW on the RN (branch site ) needs to a palo fw to support user-id redistribution.

2. Configure the collector on the RN branch firewall and on prisma access under RN template add the agent configuration.

 

If the configuration is correct, please validate if the RN(branch firewall) has the user-ip mappings i.e if you see username on logs, if not you need to ensure you have user mapping on the branch office firewall

L1 Bithead

Thank you, I configured user id on branch, group mapping is working and I can see also users from our DC.

To see user id on RN-SPN (inside prisma) I need to perform redistribution, it should be from Panorama or from branch site where is IPSec tunnel to the RN-SPN (Prisma) ?

Can we have few redistributions, or it can cause some issues like loops ?

 

L2 Linker

It should be from the branch site to Prisma Access, however, if you have user-ip mapping being sent to DC or another Palo FW you can redistribute from those devices. It is unlikely there can be a loop or conflict in redistribution when redistributing from a branch site to Prisma Access unless branch sites have similar IP pools.

  • 1473 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!