User-ID Syslog Monitoring Enhancements
The following enhancements improve the accuracy
of User-ID mappings and simplify monitoring syslog senders for mapping
information:
- Automatic deletion of user mappings—To improve the accuracy of your user-based policies and reports, you can now use syslog monitoring to detect when users have logged out; the firewall automatically deletes the associated User-ID mappings. Deleting outdated mappings is particularly useful in environments where IP address assignments change often.
- Multiple syslog formats—In environments where multiple points of authentication send syslog messages in different formats, it is now easier to collect user mappings from the messages because the firewall can ingest multiple syslog formats from the same syslog sender.
- Define custom Syslog Parse profiles so that the firewall filters syslog messages for login and logout events.Select , edit the Palo Alto Networks User-ID Agent Setup, selectSyslog Filters, andAdda Syslog Parse profile.Each profile identifies either login events or logout events, but no single profile can identify both:
- Example of Syslog Parse profile for login events:
- Example of Syslog Parse profile for logout events:
- Define the syslog senders that the firewall will monitor for syslog messages.Select andAddsyslog senders to the Server Monitoring section. For syslog senders that send messages in multiple formats,Adda Syslog Parse profile for each format. Specify the event type (loginorlogout) for each profile.As a security best practice, selectSSLwhen using the PAN-OS integrated User-ID agent to collect user mappings.
- Enable syslog listener services in the InterfaceManagement profile associated with the firewall interface used for user mapping.SelectUser-ID Syslog Listener-SSLand/orUser-ID Syslog Listener-UDPbased on the connection types you specified for the syslog senders in the previous step.
- Commit and verify your changes.
- Commityour changes.
- Log in to a client system for which a monitored syslog sender generates login and logout event messages.
- Verify that the firewall mapped the login username to the client IP address:>show user ip-user-mapping ipIP address: 192.0.2.1 (vsys1) User: localdomain\username From: SYSLOG<ip-address>
- Log out of the client system.
- Verify that the firewall deleted the user mapping:>show user ip-user-mapping ipNo matched record<ip-address>
