06-05-2023 05:51 PM
Looking into this further, it appears to be the captive portal that actually does the mapping rather than CIE - an authentication rule steers the client to the captive portal which authenticates the user (presumably via a CIE auth profile), once the user is authenticated the portal provides the mapping data as it would in any other case. In theory you could do this without CIE if you used AzureAD as your authentication source in the rule.
I've found the documentation rather sketchy when it comes to this, e.g. this KB article states CIE does not have the functionality to learn user to IP mapping which is correct - CIE itself does not provide the mapping however the documentation suggests you run show user ip-user-mapping all after configuring CIE which wouldn't work until you have a mapping source which CIE does not provide.
The best I could find is this video https://youtu.be/_ppC2H8Ta_M?t=452 which loosely shows the auth flow to CIE via a captive portal which is a standard method for mapping users to IPs when you don't have a Windows event log source (e.g. non-domain joined / BYOD): Map IP Addresses to Usernames Using Authentication Portal (paloaltonetworks.com)
So no, you don't need GlobalProtect, but I'm yet to be convinced this is reliable method that would be transparent to users without understanding the SSO methods (which will need to be either certificate based or dependent on existing authentication tokens).
It would be great if PAN could demonstrate a working end-to-end solution for this.
