Redistribute HIP Reports
To ensure consistent Host Information Profile (HIP) policy enforcement and to simplify policy management, you can distribute HIP reports received from the GlobalProtect app—and sent to an internal or external GlobalProtect gateway—to other gateways, firewalls, Dedicated Log Collectors (DLC), and Panorama appliances in the enterprise. HIP report redistribution can be useful in the following cases:
- You want to apply consistent policies to both internal and external GlobalProtect gateways.
- You want to apply consistent HIP policies for traffic for a specific user that goes through multiple firewalls.
To redistribute HIP reports, use the same deployment recommendations and best practices that you use to redistribute User-ID information.
Use the following steps to configure HIP report redistribution.
- Configure HIP-Based Policy Enforcement for your gateways and firewalls.
- Configure HIP report redistribution.
- Select DeviceUser IdentificationUser-ID Agents.
- Select an existing or Add a
new User-ID agent.The agent must be a Palo Alto Networks next-generation firewall, a GlobalProtect gateway, a DLC, or a Panorama appliance.
- Select HIP Report.
- Click OK.
- If you use GlobalProtect firewalls or gateways to distribute
HIP reports, make sure that the group mapping settings on the firewalls
or gateways that you use to redistribute the HIP reports match the
following attributes on the firewalls or gateways where you have
User-ID configured.If you use a Panorama appliance or DLC to distribute HIP reports, skip this step.
- Configure the user attributes on the HIP report redistribution firewalls or gateways to match the user attributes on the User-ID firewalls or gateways.For example, if the firewalls or gateways used for HIP report redistribution has a sAMAccountName of Primary attribute and a User Principal Name (UPN) of Alternate Username 1, make sure that you configure the same values on the firewalls or gateways where you have configured User-ID.The attributes do not have to be in the same order; for example, if the HIP report redistribution firewall has a sAMAccountName of Primary attribute and a UPN of Alternate Username 1, you can configure the User-ID firewall with a sAMAccountName of Alternate Username and a UPN of Primary attribute 1.
- If your deployment has user domains configured in its group mapping, configure the user domain attributes on the HIP report redistribution firewalls or gateways to match the user domain attributes on the User-ID firewalls or gateways. User domain attributes must be consistent across all firewalls and gateways.
- Configure the common user groups (the user groups on the firewalls and gateways that connect to the same authentication servers and retrieve the same user groups) on the HIP report redistribution firewalls or gateways to match the user groups on the User-ID firewalls or gateways.
- Redistribute the HIP reports to your managed Panorama appliances, gateways, firewalls, and virtual systems using the same workflow you use to redistribute User-ID information to managed firewalls.
HIP Report Redistribution
HIP Report Redistribution To ensure consistent Host Information Profile (HIP) policy enforcement and to simplify policy management, the HIP Report Redistribution feature enables you to ...
Learn about the exciting new GlobalProtect™ features introduced in the PAN-OS® 9.0 release. ...
Redistribute User Mappings and Authentication Timestamps
Redistribute User Mappings and Authentication Timestamps Every firewall that enforces user-based policy requires user mapping information. In a large-scale network, instead of configuring all your ...
User-ID Redistribution Using Panorama
User-ID Redistribution Using Panorama One of the key benefits of the Palo Alto Networks firewall is that it can enforce policies and generate reports based ...
Configure Access to User-ID Agents
Configure Access to User-ID Agents Each firewall and Panorama management server can connect to a maximum of 100 User-ID agents or User-ID redistribution points (or ...
Deploy User-ID in a Large-Scale Network
Deploy User-ID in a Large-Scale Network A large-scale network can have hundreds of information sources that firewalls query to map IP addresses to usernames and ...
Redistribute User-ID Information to Managed Firewalls
Redistribute User-ID Information to Managed Firewalls To ensure all the firewalls that enforce policies and generate reports have the required IP address-to-username mappings and authentication ...
Firewall Deployment for User-ID Redistribution
Firewall Deployment for User-ID Redistribution To aggregate User-ID information, organize the redistribution sequence in layers, where each layer has one or more firewalls. In the ...
GlobalProtect Features Endpoint Tunnel Configurations Based on Source Region or IP Address You can now deploy tunnel configurations for multiple user locations (internal, external, and ...