Configure User-ID Redistribution

Configure the firewall to redistribute User-ID information.
Skip this step if the firewall receives but does not redistribute User-ID information.
Select
Device
User Identification
User Mapping
.
(
Firewalls with multiple virtual systems only
) Select the
Location
. You must configure the User-ID settings for each virtual system.
You can redistribute information among virtual systems on different firewalls or on the same firewall. In both cases, each virtual system counts as one hop in the redistribution sequence.
Edit the Palo Alto Networks User-ID Agent Setup and select
Redistribution
.
Enter a
Collector Name
and
Pre-Shared Key
to identify this firewall or virtual system as a User-ID agent.
Click
OK
to save your changes.
Configure the service route that the firewall uses to query other firewalls for User-ID information.
Skip this step if the firewall receives user mapping information from Windows-based User-ID agents or directly from the information sources (such as directory servers) instead of from other firewalls.
Select
Device
Setup
Services
.
(
Firewalls with multiple virtual systems only
) Select
Global
(for a firewall-wide service route) or
Virtual Systems
(for a virtual system-specific service route), and then configure the service route.
Click
Service Route Configuration
, select
Customize
, and select
IPv4
or
IPv6
based on your network protocols. Configure the service route for both protocols if your network uses both.
Select
UID Agent
and then select the
Source Interface
and
Source Address
.
Click
OK
twice to save the service route.
Enable the firewall to respond when other firewalls query it for User-ID information.
Skip this step if the firewall receives but does not redistribute User-ID information.
Configure an Interface Management Profile with the
User-ID
service enabled and assign the profile to a firewall interface.
Commit and verify your changes.
Commit
your changes to activate them.
Access the CLI of a firewall that redistributes User-ID information.
Display all the user mappings by running the following command:
> 
show user ip-user-mapping all 
Record the IP address associated with any username.
Access the CLI of a firewall that receives redistributed User-ID information.
Display the mapping information and authentication timestamp for the
<ip_address>
you recorded:
> 
show user ip-user-mapping 
<ip_address> 
IP address:    192.0.2.0 (vsys1) 
User:          corpdomain\username1 
From:          UIA 
Idle Timeout:  10229s 
Max. TTL:      10229s 
MFA Timestamp: first(1) - 2016/12/09 08:35:04 
Group(s):      corpdomain\groupname(621) 
This example output shows the authentication timestamp for one response to an authentication challenge (factor). For Authentication policy rules that use Multi-Factor Authentication (MFA), the output shows multiple Authentication Timestamps.