There's some great comments here on this thread. One additional comment I can make that I personally get value out of is the session monitoring feature. I would suggest enabling that as well. Also, I am no kerberos / windows / AD authentication expert, but processing this through my mind, I would think you would want to make sure that there is a regular cadence of a client/server exchange that takes place on a shorter time interval than your User-ID timeout. I believe this would register an authentication event on the AD server thus transparently renewing the User/IP mapping in the client. Another thing you could try is doing NTLM authentication through Captive Portal. I tested this a bit in my infrastructure and got mixed results in regards to transparency, but it was on older versions of PanOS so that may have been the problem. Of my positive results in testing NTLM, the captive portal page displayed momentarily but then NTLM passed the user's credentials through and automatically mapped the users. Lastly, if you have PKI in your environment, you could use those certs to identify users through captive portal as well. I really like this method of doing captive portal, however the one major drawback is that there is no fail-safe or manual login option should a client fail to have the proper cert for one reason or another. We actually floated the idea of not using the UserID agents at all, and strictly forcing Captive Portal for all users, using cert base authentication. Unfortunately it was that lack of having a manual authentication option that forced us to pull the plug on that initiative. It may be more sensible in a smaller organization though. We have 25,000+ clients that connect to our network so that introduced it's own host of problems.
... View more
