About promsos

I'm wondering if there is a way to create a policy based on workstations in a certain AD group.  Here's what I'm trying to accomplish...  I want to have a security group in our Active Directory, say "Privileged Workstations" for a name.  Any workstation that is a member of the "Privileged Workstations" group will have a static IP and will need to have access to applications that are outside of our normal scope of allowed applications.  My goal is to setup a sort of self service group for our server team so if a server needs access to LogMeIn, for example, they can simply add the server to the AD group and I won't need to make any changes on my Palo Alto itself.  I do not want to write my Policy based on username as the username for the servers is not consistently identified (unless there is a way to statically create a username to ip mapping?).  Has anyone set anything up like this before?  Maybe I'm just missing something really easy, or maybe this just can't be accomplished.  Any help would be appreciated.  Thanks. Paul ... View more