Defining policy rules based on user group membership rather than individual users simplifies
administration because you don't have to update the rules whenever group membership
changes. The number of distinct user groups that each firewall or Panorama can
reference across all policy rules varies by model. For more information,
refer to the Compatibility Matrix.
For User-ID to successfully map users and for the firewall
to enforce the policy, all users must be a member of at least one group that the
firewall can map and configured in a group-based policy. To confirm if a user is a
member of a group, use the show user group list command.
The
following are best practices for group mapping in an Active Directory
(AD) environment:
- If you have a single domain, you need only one group mapping configuration with an LDAP server
profile that connects the firewall to the domain controller with the best
connectivity. You can add up to four domain controllers to the LDAP server
profile for redundancy. You can't increase redundancy beyond four domain
controllers for a single domain by adding multiple group mapping
configurations for that domain.
- If you have multiple domains or multiple forests, you must create a group mapping configuration
with an LDAP server profile that connects the firewall to a domain server in
each domain or forest. Take steps to ensure unique usernames in separate
forests.
- If you have Universal Groups, create an LDAP server profile
to connect to the root domain of the Global Catalog server on port
3268 or 3269 for SSL, then create another LDAP server profile to
connect to the root domain controllers on port 389. This helps ensure
that users and group information is available for all domains and
subdomains.
- Before using group mapping, configure a Primary Username for user-based
Security policy rules, since this attribute will identify users in the
policy configuration, logs, and reports.
