Retrieve Group Mappings Using a Master Device
Table of Contents
Retrieve Group Mappings Using a Master Device
Use a next-generation or VM-series firewall as a Master
Device to collect user and group mappings in the Prisma Access deployment.
To allow Panorama to collect group mappings, you need
to add a device group, then
designate one or more next-generation firewalls as a
Master
Device
. You can configure either an on-premises firewall
or a VM-series firewall as a master device.A master device is not the only method you
can use to collect user name-to-user group mapping. You can also configure the Directory
Sync component of the Cloud Identity Engine to
retrieve user and group information from your Active Directory (AD);
then, configure
Group Mapping Settings
in
your Mobile Users—GlobalProtect or remote network deployment.- To allow Panorama to collect group mapping information from mobile users, create a device group that specifies the on-premises or VM-series firewall as theMaster Deviceand specify this device group as aParent Device Groupof theMobile_User_Device_Groupdevice group.
- To allow Panorama to collect group mapping information from users connected to remote networks, create a device group that specifies the on-premises or VM-series firewall as theMaster Deviceand specify this device group as aParent Device Groupof theRemote_Network_Device_Groupdevice group.
- To allow Panorama to collect group mapping information from users or resources available through a service connection, create a device group that specifies the on-premises or VM-series firewall as theMaster Deviceand specify this device group as aParent Device Groupof theService_Conn_Device_Groupdevice group.
Auto-population of users and groups is only applicable
to the parent device group that is associated with the master device.
Auto-Population of users/groups is not applicable to the child device
groups (the
Mobile_User_Device_Group
, Remote_Network_Device_Group
,
or Service_Conn_Device_Group
, device groups).
See Configure an on-premises or VM-Series Firewall as a Master Device for details.The Master Devices can serve as the termination point of a remote
network connection or service connection, but this connection method
is not required for the process to work, as shown in the following
example. The following figure shows a User-ID deployment where the
administrator has configured an on-premises device as a
Master
Device
. Callouts in the figure show the process.- A next-generation on-premises or VM-series firewall that the administrator has configured as a Master Device retrieves the latest User-ID information from the LDAP server and User-ID agent in the data center.
- Panorama gets the list of usernames, user group names, and group mapping information from the Master Device.
We recommend using a Group Include List in
the LDAP server profile, so that you can specify which groups you
want to retrieve, instead of retrieving all group information.
