Dynamic User Groups

Select
Objects
Dynamic User Groups
and
Add
a new dynamic user group.
Define the membership of the dynamic user group.
Create dynamic tags to specify the criteria for members of the dynamic user group. When a user matches the criteria, the firewall adds the user to the group.
Enter a
Name
for the group.
(
Optional
) Enter a
Description
for the group.
(
Panorama only
) To share the match criteria of the dynamic user group with all device groups on Panorama, enable
Shared
dynamic user groups.
When you enable this option, the
Location
column displays whether the match criteria for the dynamic user group is available to every device group on Panorama (
Shared
) or to the selected device group.
When you enable this option, Panorama shares the match criteria of the dynamic user group; Panorama does not share the group members.
(
Panorama only
) To prevent administrators from overriding the settings of this dynamic user group in device groups that inherit the object, enable the
Disable override
option.
Add Match Criteria
using dynamic tags to define the members in the dynamic user group.
For this example, enter
questionable-activity
.
(
Optional
) Use the
And
or
Or
operators with the tags that you want to use to filter for or match against.
Click
OK
.
(
Optional
) Select the
Tags
you want to assign to the group itself.
This tag displays in the
Tags
column in the
Dynamic User Group
list and defines the dynamic group object, not the members in the group.
Click
OK
and
Commit
your changes.
If you update the user group object filter, you must commit the changes to update the configuration.
Depending on the log information that you want to use as match criteria, create a log forwarding profile or configure the log settings.
For Authentication, Data, Threat, Traffic, Tunnel Inspection, URL, and WildFire logs, create a log forwarding profile. This performs the user-to-tag mapping at the device level so that the firewall applies the policy before the firewall detects the traffic.
Select
Objects
Log Forwarding
and
Add
a log forwarding profile.
Enter a
Name
for the log forwarding profile then
Add
the
Built-in Actions
you want the firewall to take.
Select
User
as the
Target
.
(
Optional
) To return dynamic user group members to their original groups after a specific duration of time, enter a
Timeout
value in minutes (default is 0, range is 0-43200).
Specify the
Tags
that define the criteria for the members of the dynamic user group. For this example, enter
questionable-activity
.
For User-ID, GlobalProtect, and IP-Tag logs, configure the log settings. This performs the user-to-tag mapping at the traffic level so that the firewall applies the policy when it detects the user’s traffic.
Select
Device
Log Settings
.
Select the type of log that contains the information you want to use for the match criteria and
Add
it.
Enter a
Name
and
Add
your
Built-in actions
.
Enter a
Name
for each action and select
User
as the
Target
for each action.
Select the
Registration
source.
(
Optional
) To return dynamic user group members to their original groups after a specific duration of time, enter a
Timeout
value in minutes (default is 0, range is 0-43200).
Specify the
Tags
that define the criteria for the members of the dynamic user group. For this example, enter
questionable-activity
.
Use the dynamic user group in a policy to regulate traffic for the members of the group.
You will need to configure at least two rules: one to allow initial traffic to populate the dynamic user group and one to deny traffic for the activity you want to prevent (in this case,
questionable-activity
). To tag users, the rule to allow traffic must have a higher rule number in your rulebase than the rule that denies traffic.
Select
Policies
Security
.
Click
Add
and enter a
Name
and optionally add the
Tags
the policy uses.
Add the
Source Zone
to specify the zone where the traffic originates.
For the
Source User
, select the dynamic user group from Step 1.
Add the
Destination Zone
where the traffic terminates.
Select the
Service/URL Category
for the type of traffic you want to prevent.
For this example, select
questionable
for the rule that denies the traffic.
Specify the
Action
.
For the rule that denies traffic to the dynamic user group members, select
Deny
.
Clone
this rule and
Delete
the
questionable
Service/URL Category
, then select
Allow
as the
Action
to create the rule that allows the traffic to populate the dynamic user group members.
If you configured a
Log Forwarding
profile in Step 3, select it to add it to the policy.
Commit
your changes.
(
Optional
) Refine the group’s membership and define the registration source for the user-to-tag mapping updates.
If the initial user-to-tag mapping retrieves users who should not be members or if it does not include users who should be, modify the members of the group to include the users for whom you want to enforce the policy and specify the source for the mappings.
In the
Users
column, select
more
.
Register Users
to add them to the group and select the
Registration Source
for the tags and user-to-tag mappings.
Local
(Default)—Register the tags and mappings for the dynamic user group members locally on the firewall.
Panorama User-ID Agent
—Register the tags and mappings for the dynamic user group members on a User-ID agent connected to Panorama. If the dynamic user group originates from Panorama, the row displays in yellow and the group name, description, match criteria, and tags are read-only. However, you can still register or unregister users from the group.
Remote device User-ID Agent
—Register the tags and mappings for the dynamic user group members on a remote User-ID agent. To select this option, you must first configure an HTTP server profile.
Select the
Tags
you want to register on the source using the tags you used to configure the group.
(
Optional
) To return dynamic user group members to their original groups after a specific duration of time, enter a
Timeout
value in minutes (default is 0, range is 0-43200).
Add
or
Delete
users as necessary.
(
Optional
)
Unregister Users
to remove their tags and user-to-tag mappings.
Verify the firewall correctly populates the users in the dynamic user group.
Confirm the
Dynamic User Group
column in the Traffic, Threat, URL Filtering, WildFire Submissions, Data Filtering, and Tunnel Inspection logs displays the dynamic user groups correctly.
Use the
show user group list dynamic
command to display a list of all dynamic user groups as well as the total number of dynamic user groups.
Use the
show object registered-user all
command to display a list of users who are registered members of dynamic user groups.
Use the
show user group name
group-name
command to display information about the dynamic user group, such as the source type.
Monitor the users in your dynamic user groups to track user activity.
In the Application Command Center (ACC), create a global or local filter to track the dynamic user group (
Add
User
Dynamic User Group
).
Generate user activity reports for members of dynamic user groups (
Monitor
PDF Reports
User Activity Report
) to determine if more malicious activity occurs.