Standalone Prisma Access Group Based Policies

[RaymondMullin]

I'm trying to implement group-based policies in a standalone Prisma Access deployment. The instructions for achieving this are really lacking. Can anyone clarify how to configure group based policy mapping?

From the KB article:

Implement User-ID in Security Policies For a Standalone Prisma Access Deployment In a standalone Prisma Access deployment without a Master Device, you can use group-based policy using long-form DN entries in Panorama. Prisma Access uses the DN entries to evaluate the User-ID-based policies you have configured in Panorama. For example, given a User named Bob Alice who works in IT for Organization Hooli in the United States, a matching security policy may have ou=IT Staff,O=Hooli,C=US if the policy is to be applied to all IT staff, or CN=Bob Alice,ou=IT Staff,O=Hooli,C=US if the policy is only to be applied to Bob Alice.

[RaymondMullin]

I'm trying to implement group-based policies in a standalone Prisma Access deployment. The instructions for achieving this are really lacking. Can anyone clarify how to configure group based policy mapping?

From the KB article:

Implement User-ID in Security Policies For a Standalone Prisma Access Deployment In a standalone Prisma Access deployment without a Master Device, you can use group-based policy using long-form DN entries in Panorama. Prisma Access uses the DN entries to evaluate the User-ID-based policies you have configured in Panorama. For example, given a User named Bob Alice who works in IT for Organization Hooli in the United States, a matching security policy may have ou=IT Staff,O=Hooli,C=US if the policy is to be applied to all IT staff, or CN=Bob Alice,ou=IT Staff,O=Hooli,C=US if the policy is only to be applied to Bob Alice.

[shkumar]

Hey Raymond,

If I understand correctly then your Prisma Access setup is standalone thus there is no on-prem device available on Panorama.

in that situation, at the moment the Panorama is not capable of fetching group mapping today thus we do not see the group name list on Device group rules.

The workaround for this is to use the get Distinguished Name format from the AD server and paste it on the Panorama rules, user column.

To get DN format of group name run the below command on the AD server:

C:\Users\Administrator>dsquery group -name employee
"CN=Employee,CN=Users,DC=alvisofin,DC=com"

In the above example employee is a group name on the AD server.

Thanks,

Shakti