About FDEMUYTER

Hi Housing1, As of today I am not aware of any direct integration with Azure AD.(used id agent for azure)  If you have Azure Active Directory Domain Services you could get group mappings using ldaps.  https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/authentication/enable-group-mapping.html . To get the user info you could use a global protect client internal portal for authentication only using SAML. (portal non-tunnel model) Or you can setup a captive portal with SAML authentication to Azure AD. Depends on you use case. I think the best option is to use global protect client.   For windows laptops no license is needed only for mobile endpoints and linux clients.           ... View more

Hi, There are different options for your problem but moving everything to the cloud will need carefull planning and decisions up front. A good read is also: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/compare-identity-solutions   Also please have a look into Prisma if you are moving to full cloud.   ... View more

Hi Olsen,   If you are using Cisco ISE you could try forwarding you logs to a palo alto user id agent configured as a syslog listener. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users/configure-user-id-to-monitor-syslog-senders-for-user-mapping I have not tried it myself but was also something i was thinking about.  Another thing you could to is use an internal portal only without creating a tunnel but only for authentication. This is called a non-tunnel mode gateway. (always on configuration) https://docs.paloaltonetworks.com/globalprotect/8-0/globalprotect-admin/globalprotect-gateways/globalprotect-gateway-concepts/types-of-gateways This will require you to deploy global protect to all your clients. This solution will give you the most accurate solution I think. I am assuming all your users and computer are in azure ad only? How are your users authenticated on the WIFI?     ... View more

Hi Olson,   No user-id agent for azure directly but you can solve this issue by using global protect and SAML authentication. It depends on what you need and what is your use-case. What do you want to accomplish in the end? You can also look into Prisma.     ... View more

Hi. what you could to to get the user id is use global protect client with SAML authentication to azure. You can connect to internal or external portal and use always on.  ... View more

Hi Jeff,   Any idea if this i a feature that will be introduced or palo alto is considering this? ... View more

Hi Jeff,   I have dropped you an e-mail with my contact details.  To get around this limitation i could maybe user a captive portal and SAML SSO? In my case these user are all on a seperate segment. I will have to test this out.   Never the less  integrating User-ID with Azure AAD would be a good enhancement.     ... View more

6:39:52:897 Debug( 545): Failed to connect to 81.83.18.57 on 443 with return error -1 and socket error 0(The operation completed successfully.) (T5540) 03/15/18 16:39:52:897 Debug( 697): do_tcp_connect() failed (T5540) 03/15/18 16:39:52:897 Error(7700): ConnectSSL: Failed to connect to '81.83.18.57:443'. Disconnect ssl. (T5540) 03/15/18 16:39:52:897 Debug(7711): Cannot get server cert of 81.83.18.57 (T5540) 03/15/18 16:39:52:897 Debug(5145): Already tried both ipv4 and ipv6 for gateway fw.relianet.be (T5540) 03/15/18 16:39:52:897 Error(2845): Failed to verify server certificate of gateway fw.relianet.be. (T5540) 03/15/18 16:39:52:897 Debug(4576): Show Gateway fw.relianet.be: The server certificate is invalid. Please contact your IT administrator. (T5540) 03/15/18 16:39:52:897 Info (2148): Failed to retrieve info for gateway fw.relianet.be. (T5540) 03/15/18 16:39:52:897 Debug(2155): tunnel to fw.relianet.be is not created. (T5540) 03/15/18 16:39:52:897 Error(3876): NetworkDiscoverThread: failed to discover external network. (T5540) 03/15/18 16:39:52:897 Debug(4733): --Set state to Disconnected   I also remove the global protect client and clear the folders in C:\Users\username\appddata\local\Palo alto\... Everytime i change something.   ... View more

Hi andy,   I have a certificate with subject and SAN set to fw.relianet.be     I modified it as you suggest for testing but still have the same result:   gateways {           external {             list {               fw.relianet.be {                 ip {                   ipv4 81.83.18.57;                 }                 priority-rule {                   Any {                     priority 1;                   }   If  you need any other output screenshots please let me know.   Tnx,   Frederik.   ... View more