End-of-Life (EoL)
Redistribute User-ID Information to Managed Firewalls
To ensure all the firewalls that enforce policies
and generate reports have the required IP address-to-username mappings
and authentication timestamps for your entire
user base, you can leverage your Panorama and distributed log collection
infrastructure to redistribute the mappings and timestamps.
Before
you configure User-ID
Redistribution Using Panorama and Log Collectors:
- Configure user mapping using PAN-OS Integrated User-ID agents or Windows-based User-ID Agents.
- Configure the firewalls to redistribute User-ID information.
- Configure a Dedicated Log Collector to redistribute User-ID information.A Log Collector that is local to the Panorama management server does not redistribute User-ID information.
- Add Panorama, firewalls, or virtual systems as User-ID redistribution points to a Log Collector:
- Selectand select the Log Collector to edit it.PanoramaManaged Collectors
- SelectUser-ID AgentsandAdda redistribution point.
- Enter aNameto identify the redistribution point.
- Enter theHostname or IP address of the interface on the firewall or Panorama that will respond to User-ID information queries from the Log Collector.
- Enter thePortnumber on which Panorama or the firewall will listen for User-ID information queries (default is 5007).
- If the redistribution point is a firewall or virtual system, enter theCollector NameandCollector Pre-Shared Key.In this context, the collector is a User-ID collector, not a Log Collector.
- ClickOKto save your changes.
- Enable the management (MGT) interface of the Log Collector to respond to User-ID information queries from Panorama or firewalls:
- Selectand select the Log Collector to edit it.PanoramaManaged Collectors
- SelectInterfacesandManagement.
- SelectUser-IDin the Network Connectivity Services section and clickOK.
- ClickOKto save your changes to the Log Collector.
- Selectto activate your changes on Panorama and push the changes to the Log Collector.CommitCommit and Push
- Configure the Panorama management server to redistribute User-ID information.
- Add Log Collectors, firewalls, or virtual systems as redistribution points to Panorama:
- SelectandPanoramaUser IdentificationAddeach redistribution point.
- Enter aNameto identify the redistribution point.
- Enter theHostname or IP address of the MGT interface on the Log Collector or firewall.
- Enter thePortnumber on which the Log Collector or firewall will listen for User-ID information queries (default is 5007).
- If the redistribution point is a firewall or virtual system, enter theCollector NameandCollector Pre-Shared Key.
- ClickOKto save the configuration.
- Enable the Panorama MGT interface to respond to User-ID information queries from Log Collectors or firewalls:If the Panorama management server has a high availability (HA) configuration, perform this step on each HA peer as a best practice so that redistribution continues if Panorama fails over.
- SelectandPanoramaSetupInterfacesManagement.
- SelectUser-IDin the Network Connectivity Services section and clickOK.
- Selectto activate your changes on Panorama.CommitCommit to Panorama
- Configure firewalls to receive User-ID information from Panorama or Log Collectors.If you are using Panorama to manage both your firewall and the Dedicated Log Collector (DLC), and you want to configure the firewall to receive User-ID information from Panorama or the log collectors, add the User-ID agent using the serial number to the Panorama template, then push the template to the firewall. If you add the User-ID agent on the firewall using the serial number, you will only see Panorama and not the DLC, and you will need to add the DLC to the firewall using the host and port number.
- Select, select theDeviceUser IdentificationUser-ID AgentsTemplateto which the firewalls are assigned, andAddone of the following as a redistribution point:
- Panorama—Add an Agent UsingtheSerial Number, and set theSerial Numbertopanoramafor the active or solitary Panorama or topanorama2(HA only) for the passive Panorama.
- Log Collector—Add an Agent UsingtheHost and Port. Enter theHostname or IP address of the MGT interface on the Log Collector. Then enter thePortnumber on which the Log Collector listens for User-ID information queries (default is 5007).
- ClickOKto save the configuration.
- Selectto activate your changes on Panorama and push the changes to the firewalls.CommitCommit and Push
- Verify that Panorama, Log Collectors, and firewalls receive redistributed user mappings.
- Access the CLI of a firewall, Log Collector, or Panorama management server that redistributes User-ID information.
- Display all the user mappings by running the following command:>show user ip-user-mapping all
- Record the IP address associated with any one username.
- Access the CLI of a firewall, Log Collector, or Panorama management server that receives redistributed User-ID information.
- Display the mapping information and authentication timestamp for the<IP-address>you recorded:>show user ip-user-mapping ipIP address: 192.0.2.0 (vsys1) User: corpdomain\username1 From: UIA Idle Timeout: 10229s Max. TTL: 10229s MFA Timestamp: first(1) - 2016/12/09 08:35:04 Group(s): corpdomain\groupname(621)<IP-address>This example output shows the timestamp for a response to one authentication challenge (factor). For Authentication rules that use multi-factor authentication (MFA), the output shows multiple timestamps.
Recommended For You
Recommended Videos
Recommended videos not found.