About jezkerwin

Thanks for your reply @Remo,    Aren't there some features that Agentless UserID doesn't haved compared to the Agent?   The problem I had when the remote firewalls were talking to the Core UserID agent was the time it took for the database to update with the IP address, so some users were waiting a long time for the rules to reconigse they had logged onto the network. I suspect I have some configuration settings in terms of time to retrieve logs, etc, aren't configured correctly (I've just used the defaults of the agent install).   While our network links don't go offline that often, I wouldn't describe them as reliable which is why I went down the path of local UserID agents at the main datacentre sites other than HQ.   Perhaps I could look at the panorama to distribute the database.   The other option I was thinking is this. We have 2 sites that are the biggest. each site has 2 x userID agents installed and configured. The F/Ws at those sites are configured for the local UserID agents. then those local F/Ws are configured to distribute their databases to all the other F/Ws in the environment. ... View more

Thanks for your reply.   At the moment, we don't have a need to use UserID across firewalls and VSYS, however I do see a need in the future so I would the answer to that question is yes. We use Panorama and all the firewalls are configured to talk to it. we use it for firmware updates but due to the nature of our enviornment, we're not using it for rule managmenet. The domains do exist within the same environment so there is a trust between them.    I didn't know we could use Exchange. In some cases a user would be using a workstation that doesn' have Outlook. The exchange environment sits in a resource type forest, there is a forest trust between those domains. We use OCS that for most people starts automatically.   I think the questions are still open for me are, do I continue to use direct polling to the domain controllers or implement something with event forwarding, the location of the userID agent on the network for best performance and the firewall configuration to query them and how to implement redundancy incase one of the userID agents fails.   Thanks again for your help. ... View more

Yeah, I'm talking about the nomenclature of the AD security groups themselves.   I guess I'm in a different position where I have the input in naming both. ... View more

I'm interested to learn how people name their groups within Active Directory that are used within the Palo Alto Firewall Policies. Are they named randomly or does the name of the group identify what the policy does within the firewall.   I'm looking to come up with a naming scheme for myself that makes sense, is easy to manage and has relevance when identifying the policy within the firewall so I'd like to learn if others have come up with a scheme or system that they use that I could draw inspiration on for my requirements.   For example, if a policy is giving RDP access to a bunch of servers on floor 3 of office 1 is the rule named 'Off_1_Flr_3_RDP_allow' or is it called 'access to rdp for developers'. ... View more

Hey thanks for the reply, it certainly does help. I have a couple of follow up questions if you dont mind, just to help me get it clear in my head.   1) Do you have cross domain group memberships for users being resolved correctly (ie. you set a group in a policy from domain1 and that group has a member from domain2 in it) 2) For each of the LDAP profiles you use for the each of the domain are you using one Bind user per domain or a single Bind user for all domains? Are you connecting to LDAP port (389) or the Global Catalog (3268) 3) Do you have the same number of Group Mapping profiles for each of the domains? Are you setting the User Domain variable and just keeping the rest of the variables standard. 4) If I understand your explanation, you have 4 servers running the UserID Agent for load sharing and they are all member servers in a single domain using the one service account and they can match IP address to Username across all domains due to the trust?   Thanks for you help, I really appreciate it, this'll get me out of jam if I get it going.   Cheers. ... View more

correct, in the monitor tab I can correctly see domainB\user being resolved. in the policy though, if I configure domainA\group as the user and domainB\user is a member of that group, it wasn't resolving the lookup to the group and the policy would fail.   I'm not sure which group type to user Global, Domain Local, Universal. I have the LDAP server profile talking to the Global Catalog.   I'll try with the second LDAP profile talking to domainB and see if that works.     ... View more