requires that you configure IP address-to-username mapping to consistently
enforce user-based policy for mobile users and users at remote network locations. In
addition, you need to configure username to user-group mapping if you want to
enforce policy based on group membership.
To select the groups from a drop-down list when you create and configure policies in
Panorama, you can also configure Panorama to obtain the list of user groups retrieved
from the username-to-user group mapping.
The following sections provide an overview and the steps you perform to configure and
implement User-ID and use the Cloud Identity Engine to get IP address-to-username and
username-to-user group mapping in
is connected to Cloud Identity Engine, and that
Cloud Identity Engine is sharing directory information with
Prisma Access
.
Check that you can see your directories in
Prisma Access
.
Go to
Manage
Configuration
Identity Services
Cloud Identity Engine
.
If you're using Strata Cloud Manager, go to
Manage
Configuration
NGFW and
Prisma Access
Identity Services
Cloud Identity Engine
.
Verify that you can add users and groups to a policy rule.
Select
Manage
Security Services
Security
or
Decryption
.
If you're using Strata Cloud Manager, go to
Manage
Configuration
NGFW and
Prisma Access
Security Services
Decryption
.
In a security or decryption policy rule, check that the
Users
dropdown displays your Active Directory
user and group entries. Now you can start adding these users and groups to
your security and decryption policy rules.
When you've confirmed that Cloud Identity Engine is
successfully connected, you can begin running user activity reports to gain greater
visibility into the behavior of your user base.
Prisma Access
User-Based Policy (
Panorama
)
Set up user-ID mapping in
Prisma Access (Managed by Panorama)
.
This section provides the steps you perform
to configure User-ID for
Prisma Access
.
Configure
IP address-to-username mapping for your mobile users and users at
remote network locations.
For Mobile Users—GlobalProtect deployments, the
GlobalProtect agent in
We recommend using
a Group Include List in
the LDAP server profile, so that you can specify which groups you
want to retrieve, instead of retrieving all group information.
Allow Panorama
to use username-to-user group mapping in security policies by completing
one of the following actions:
