Client Probing
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > GTP Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Device Block List
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Scheduled Config Export
Client Probing
- DeviceUser IdentificationUser MappingPalo Alto Networks User-ID Agent SetupClient Probing
You can configure the User-ID agent to perform WMI client probing
for
each client system that the user mapping process identifies. The
User-ID agent will periodically probe each learned IP address to
verify that the same user is still logged in. When the firewall
encounters an IP address for which it has no user mapping, it sends the
address to the User-ID agent for an immediate probe. To configure
client probing settings, complete the following fields.
for
each client system that the user mapping process identifies. The
User-ID agent will periodically probe each learned IP address to
verify that the same user is still logged in. When the firewall
encounters an IP address for which it has no user mapping, it sends the
address to the User-ID agent for an immediate probe. To configure
client probing settings, complete the following fields.Do not enable client probing on high-security
networks. Do not enable client probing on external untrusted interfaces.
Client probing can generate a large amount of network traffic, can
pose a security threat when misconfigured, and if enabled on an
external untrusted zone, client probing could allow an attacker
to send a probe outside of your network and result in disclosure
of the User-ID agent service account name, domain name, and encrypted
password hash. Instead, collect user mapping information from more
isolated and trusted sources, such as domain controllers and through
integrations with Syslog or the XML API, which have the added benefit
of allowing you to safely capture user mapping information from
any device type or operating system, instead of just Windows clients.
The complete procedure
to configure the
PAN-OS integrated User-ID agent to probe clients requires additional
tasks besides configuring the client probing settings.
to configure the
PAN-OS integrated User-ID agent to probe clients requires additional
tasks besides configuring the client probing settings.The
PAN-OS Integrated User-ID agent does not support NetBIOS probing
but the Windows-based User-ID agent
does support it.
does support it.Client Probing Settings | Description |
|---|---|
Enable Probing | Select this option to enable WMI probing. |
Probe Interval (min) | Enter the probe interval in minutes (range
is 1-1440; default is 20). This is the interval between when the
firewall finishes processing the last request and when it starts
the next request. In large deployments, it is important to
set the interval properly to allow time to probe each client that
the user mapping process identified. Example, if you have 6,000
users and an interval of 10 minutes, it would require 10 WMI requests
per second from each client. If the probe request load
is high, the observed delay between requests might significantly
exceed the interval you specify. |