Set Up Identity Redistribution

Confirm Your Service Connection Setup.
If you haven’t yet set up a service connection for your HQ or data centers, begin by configuring a service connection. A service connection is required for Prisma Access to share identity data across your environment;
Prisma Access
automatically enables service connections to work as redistribution agents. A newly created service connection site will be ready to be used as a redistribution agent when you see that it's been assigned a User-ID agent Address (
Prisma Access
does this automatically, and it'll just take a few minutes).
User-ID Redistribution Management
—Sometimes, granular controls are needed for user-ID redistribution in particularly large scale
Prisma Access
deployments. User-ID Redistribution Management lets you manually disable the default identity redistribution behavior for certain service connections by removing the check mark in the
User ID
column, and then select specific service connections to be used for identity redistribution. It's not necessary to do this for most configurations. Contact Palo Alto Networks support to activate this functionality.
Go to
Manage
Configuration
NGFW and
Prisma Access
Identity Services
Identity Redistribution
set the configuration scope to
Service Connections
to verify the service connection User-ID agent details.
Send Identity Data from
Prisma Access
to on-premises Devices.
The service connection’s User-ID agent information is all you need to configure
Prisma Access
to distribute identity data to on-premises devices.
Go to
Manage
Configuration
Identity Services
Identity Redistribution
and set the configuration scope to
Service Connections
to get the service connection User-ID agent details.
If you're using Strata Cloud Manager, go to
Manage
Configuration
NGFW and
Prisma Access
Identity Services
Identity Redistribution
set the configuration scope to
Service Connections
to get the service connection User-ID agent details.
Use these details to configure
Prisma Access
as a data redistribution agent on Panorama or a Palo Alto Networks NGFW.

Send Identity Data from on-premises Devices to
Prisma Access
.
Add on-premises devices to
Prisma Access
as redistribution agents; the devices you add will be able to distribute identity data to Prisma Access.
From devices at remote network sites:

Go to the

Identity Redistribution

dashboard, set the configuration scope to

Remote Networks

, and

Add Agent

. In addition to specifying the host details, select the type of data the device shares with

Prisma Access

. Optional settings include the name and a pre-shared key for the device.



From devices at service connection sites:

Go to the

Identity Redistribution

dashboard, set the configuration scope to

Service Connections

, and

Add Agent

. In addition to specifying the host details, select the type of data the device shares with

Prisma Access

. Optional settings include the name and a pre-shared key for the device.


Configure the Terminal Server agent for User Mapping.
The Terminal Server (TS) agent allocates a port range to each user to identify specific users on Windows-based terminal servers. The TS agent notifies
Prisma Access
of the allocated port ranges, so that Prisma Access can enforce policy based on users and user groups.
On the
Identity Redistribution
dashboard, set the configuration scope to
Remote Networks
, and
Add Terminal Server Agent
under
Terminal Server Sending to Remote Networks Nodes
.
By default, the configuration is

Enabled

.

Enter a

Name

for the TS agent.

Enter the IP address of the Windows

Host

on which the TS agent is installed.

Enter the

Port

number on which the agent listens for user mapping requests. The port is set to 5009 by default.

Save

your changes.


Distribute Identity Data Across Your
Prisma Access
Environment.
On the
Identity Redistribution
dashboard,
Edit
the diagram to specify the identity data you want to collect from each source and share across
Prisma Access
.

To activate your changes, push the configuration to
Prisma Access
.