Deploy User-ID Based Policy for Cloud NGFW for AWS

1. Retrieve User-Group mapping source from Panorama for CNGFW for AWS.

   Review your Panorama configuration for User-Group mappings. Determine whether Panorama is acquiring user-to-group mappings from Cloud Identity Engine or an LDAP/Active Directory server.

   • If using Cloud Identity Engine: Open the Panorama console and verify that Cloud Identity Engine is integrated with Panorama for user group mappings. No IP address or port extraction is required for the Resource Gateway configuration—mappings are automatically learned and synced to Cloud NGFW.
   • If using LDAP/Active Directory:
     1. In the Panorama console, select DeviceServer ProfilesLDAP.
     2. Open your active LDAP server profile.
     3. In the Server List table, note the exact static private IP address of your Active Directory/LDAP server (for example, 172.31.27.193) and the port number (389 or 636).
     4. Select User IdentificationGroup Mapping and verify that the group mapping profile references this LDAP server profile and that the Active Directory tree is pulling directory containers.
2. Retrieve User-IP redistribution agent from Panorama.

   Review your Panorama configuration for the User-IP redistribution agent.

   You must have the exact native Private IP address and port number (typically 5007). Make sure to record the native private IP address rather than any transformed endpoint string, as this exact IP and port combination will be required when setting up your AWS Resource Configuration.
3. Create and share the AWS Resource Gateway configuration.

   1. In the AWS Console, go to the Resource Gateway service page and click Create Resource Gateway.

   2. Specify a unique identifier, choose your network stack properties (IPv4, IPv6, or Dual Stack), assign the target client VPC, and configure your security groups, then click Create.
   3. Go to Resource Configuration and click Create Configuration.
   4. Choose your configuration type and resource definition type.
   5. Enter the exact private IP address and port ranges of your destination resource (for example, your Panorama instance or primary Active Directory/LDAP server), then click Create Resource Configuration.
   6. In the Cloud NGFW Console, go to the Firewall page, open the Private Access tab, and copy the Deployment Plane Account ID.

      The DP Account ID is found in your CNGFW Console Private Access Tab. See Step 4.
   7. In the AWS Resource Access Manager (RAM) dashboard, create a new resource share. Attach the Amazon Resource Name (ARN) of the resource configuration you created, paste the copied Deployment Plane Account ID as the principal recipient, and click Share.

      The platform automatically accepts the share request.
4. Map private resources in the Cloud NGFW Console.

   1. In the Cloud NGFW Console, go to the Private Access tab.

   2. Click Add

      • A maximum of 2 ARNs can be configured when the resource configuration type is Single.
      • A maximum of 40 ARNs can be configured when the resource configuration type is Group.
   3. Enter a tracking name and choose Group or Single as the Resource Configuration Type.
   4. For Host, enter the same static private IP address you used when building the AWS resource configuration.
   5. Enter the Parent ARN and Child ARN from your AWS resource configuration, then click Add.

      After you save the mapping, the backend automatically provisions a VPC endpoint link connecting the deployment plane to the client network through the resource gateway. The link displays one of the following statuses:

      • Pending: The communication pathway is actively being established.
      • Available: The network pathway is ready. This status confirms the infrastructure endpoint exists but does not validate whether target host IP entries are reachable or free from local firewall restrictions.
      • Failed: The account alignment validation failed or access was denied.

   Configure User-ID redistribution agents in Panorama

   1. In Panorama, select DeviceData Redistribution and click Add.
   2. For Host, enter the private IP address of the redistribution agent.
   3. For Port, enter 5007.

   Configure the LDAP server profile in Panorama

   1. In Panorama, select DeviceServer ProfilesLDAP and click Add.
   2. Configure the profile with your Active Directory server details:

      • Type/Host: Enter the private IP address of your Active Directory server.
      • Base DN: Define your directory structure (for example, DC=demo,DC=local).
      • Credentials: Enter the lookup account credentials and authentication type.

   Map Group Identifications in Panorama.

   1. In Panorama, go to User Identification and create a new group mapping that references the LDAP server profile you configured.
   2. Under the group include list, click Add.

      Select Add under the group include window to verify the network path. The environment pulls your Active Directory tree dynamically to confirm the Resource Gateway route is functional.

      Dynamic group population in drop-down menus during policy authoring requires configuring your Cloud Device Group as a child of a regular Device Group with an assigned master device. For more information, see Map User to Groups and Manage your Device group configurations.
   3. Select the directory containers you want to enforce policy on (for example, Human Resources or Administrators).

   Build Security Policies

   Build security policies in your Panorama device group to enforce controls based on user identity.

   • User group rule: Define a rule identifying a source group (for example, demo/all-user-groups) directed to a specific destination with the action Deny.
   • Individual user rule: Define a rule for a specific source user account (for example, demo/paloalto) directed to a specific destination with the action Deny.
5. In Panorama, Commit and Push to Devices to push the security changes to your firewalls.