User-ID

PANOS
Administrators
Guide
Version8.0
ContactInformation

CorporateHeadquarters:
PaloAltoNetworks
4401GreatAmericaParkway
SantaClara,CA95054
www.paloaltonetworks.com/company/contactus

AboutthisGuide

ThisguidetakesyouthroughtheconfigurationandmaintenanceofyourPaloAltoNetworksnextgeneration
firewall.Foradditionalinformation,refertothefollowingresources:

ForinformationonhowtoconfigureothercomponentsinthePaloAltoNetworksNextGenerationSecurity
Platform,gototheTechnicalDocumentationportal:https://www.paloaltonetworks.com/documentationor
searchthedocumentation.

Foraccesstotheknowledgebaseandcommunityforums,refertohttps://live.paloaltonetworks.com.

Forcontactingsupport,forinformationonsupportprograms,tomanageyouraccountordevices,ortoopena
supportcase,refertohttps://www.paloaltonetworks.com/support/tabs/overview.html.

ForthemostcurrentPANOSandPanorama8.0releasenotes,goto
https://www.paloaltonetworks.com/documentation/80/panos/panosreleasenotes.html.
Toprovidefeedbackonthedocumentation,pleasewritetousat:documentation@paloaltonetworks.com.

PaloAltoNetworks,Inc.
www.paloaltonetworks.com
2017PaloAltoNetworks,Inc.PaloAltoNetworksisaregisteredtrademarkofPaloAltoNetworks.Alistofourtrademarkscanbefound
athttp://www.paloaltonetworks.com/company/trademarks.html.Allothermarksmentionedhereinmaybetrademarksoftheir
respectivecompanies.

RevisionDate:July11,2017

2 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.
 UserID
Theuseridentity,asopposedtoanIPaddress,isanintegralcomponentofaneffectivesecurity
infrastructure.Knowingwhoisusingeachoftheapplicationsonyournetwork,andwhomayhave
transmittedathreatoristransferringfiles,canstrengthensecuritypoliciesandreduceincidentresponse
times.UserID,astandardfeatureonthePaloAltoNetworksfirewall,enablesyoutoleverageuser
informationstoredinawiderangeofrepositories.ThefollowingtopicsprovidemoredetailsaboutUserID
andhowtoconfigureit:
UserIDOverview
UserIDConcepts
EnableUserID
MapUserstoGroups
MapIPAddressestoUsers
EnableUserandGroupBasedPolicy
EnablePolicyforUserswithMultipleAccounts
VerifytheUserIDConfiguration
DeployUserIDinaLargeScaleNetwork

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 407

Copyright 2007-2017 Palo Alto Networks

UserIDOverview UserID

UserIDOverview

UserIDenablesyoutoidentifyallusersonyournetworkusingavarietyoftechniquestoensurethatyou
canidentifyusersinalllocationsusingavarietyofaccessmethodsandoperatingsystems,including
MicrosoftWindows,AppleiOS,MacOS,Android,andLinux/UNIX.Knowingwhoyourusersareinstead
ofjusttheirIPaddressesenables:
VisibilityImprovedvisibilityintoapplicationusagebasedonusersgivesyouamorerelevantpictureof
networkactivity.ThepowerofUserIDbecomesevidentwhenyounoticeastrangeorunfamiliar
applicationonyournetwork.UsingeitherACCorthelogviewer,yoursecurityteamcandiscernwhatthe
applicationis,whotheuseris,thebandwidthandsessionconsumption,alongwiththesourceand
destinationoftheapplicationtraffic,aswellasanyassociatedthreats.
PolicycontrolTyinguserinformationtoSecuritypolicyrulesimprovessafeenablementofapplications
traversingthenetworkandensuresthatonlythoseuserswhohaveabusinessneedforanapplication
haveaccess.Forexample,someapplications,suchasSaaSapplicationsthatenableaccesstoHuman
Resourcesservices(suchasWorkdayorServiceNow)mustbeavailabletoanyknownuseronyour
network.However,formoresensitiveapplicationsyoucanreduceyourattacksurfacebyensuringthat
onlyuserswhoneedtheseapplicationscanaccessthem.Forexample,whileITsupportpersonnelmay
legitimatelyneedaccesstoremotedesktopapplications,themajorityofyourusersdonot.
Logging,reporting,forensicsIfasecurityincidentoccurs,forensicsanalysisandreportingbasedonuser
informationratherthanjustIPaddressesprovidesamorecompletepictureoftheincident.Forexample,
youcanusethepredefinedUser/GroupActivitytoseeasummaryofthewebactivityofindividualusers
orusergroups,ortheSaaSApplicationUsagereporttoseewhichusersaretransferringthemostdata
overunsanctionedSaaSapplications.
Toenforceuserandgroupbasedpolicies,thefirewallmustbeabletomaptheIPaddressesinthepackets
itreceivestousernames.UserIDprovidesmanymechanismstocollectthisUserMappinginformation.For
example,theUserIDagentmonitorsserverlogsforlogineventsandlistensforsyslogmessagesfrom
authenticatingservices.ToidentifymappingsforIPaddressesthattheagentdidntmap,youcanconfigure
AuthenticationPolicytoredirectHTTPrequeststoaCaptivePortallogin.Youcantailortheusermapping
mechanismstosuityourenvironment,andevenusedifferentmechanismsatdifferentsitestoensurethat
youaresafelyenablingaccesstoapplicationsforallusers,inalllocations,allthetime.

Figure:UserID

408 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID UserIDOverview

Toenableuserandgroupbasedpolicyenforcement,thefirewallrequiresalistofallavailableusersand
theircorrespondinggroupmembershipssothatyoucanselectgroupswhendefiningyourpolicyrules.The
firewallcollectsGroupMappinginformationbyconnectingdirectlytoyourLDAPdirectoryserver,orusing
XMLAPIintegrationwithyourdirectoryserver.
SeeUserIDConceptsforinformationonhowUserIDworksandEnableUserIDforinstructionsonsetting
upUserID.

UserIDdoesnotworkinenvironmentswherethesourceIPaddressesofusersaresubjectto
NATtranslationbeforethefirewallmapstheIPaddressestousernames.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 409

Copyright 2007-2017 Palo Alto Networks

UserIDConcepts UserID

UserIDConcepts

GroupMapping
UserMapping

GroupMapping

Todefinepolicyrulesbasedonuserorgroup,firstyoucreateanLDAPserverprofilethatdefineshowthe
firewallconnectsandauthenticatestoyourdirectoryserver.Thefirewallsupportsavarietyofdirectory
servers,includingMicrosoftActiveDirectory(AD),NovelleDirectory,andSunONEDirectoryServer.The
serverprofilealsodefineshowthefirewallsearchesthedirectorytoretrievethelistofgroupsandthe
correspondinglistofmembers.Ifyouareusingadirectoryserverthatisnotnativelysupportedbythe
firewall,youcanintegratethegroupmappingfunctionusingtheXMLAPI.Youcanthencreateagroup
mappingconfigurationtoMapUserstoGroupsandEnableUserandGroupBasedPolicy.
Definingpolicyrulesbasedongroupmembershipratherthanonindividualuserssimplifiesadministration
becauseyoudonthavetoupdatetheruleswhenevernewusersareaddedtoagroup.Whenconfiguring
groupmapping,youcanlimitwhichgroupswillbeavailableinpolicyrules.Youcanspecifygroupsthat
alreadyexistinyourdirectoryserviceordefinecustomgroupsbasedonLDAPfilters.Definingcustom
groupscanbequickerthancreatingnewgroupsorchangingexistingonesonanLDAPserver,anddoesnt
requireanLDAPadministratortointervene.UserIDmapsalltheLDAPdirectoryuserswhomatchthefilter
tothecustomgroup.Forexample,youmightwantasecuritypolicythatallowscontractorsintheMarketing
Departmenttoaccesssocialnetworkingsites.IfnoActiveDirectorygroupexistsforthatdepartment,you
canconfigureanLDAPfilterthatmatchesusersforwhomtheLDAPattributeDepartmentissetto
Marketing.Logqueriesandreportsthatarebasedonusergroupswillincludecustomgroups.

UserMapping

Knowinguserandgroupsnamesisonlyonepieceofthepuzzle.ThefirewallalsoneedstoknowwhichIP
addressesmaptowhichuserssothatsecurityrulescanbeenforcedappropriately.Figure:UserIDillustrates
thedifferentmethodsthatareusedtoidentifyusersandgroupsonyournetworkandshowshowuser
mappingandgroupmappingworktogethertoenableuserandgroupbasedsecurityenforcementand
visibility.Thefollowingtopicsdescribethedifferentmethodsofusermapping:
ServerMonitoring
PortMapping
Syslog
XFFHeaders
AuthenticationPolicyandCaptivePortal
GlobalProtect
XMLAPI
ClientProbing

410 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID UserIDConcepts

ServerMonitoring

WithservermonitoringaUserIDagenteitheraWindowsbasedagentrunningonadomainserverinyour
network,ortheintegratedPANOSUserIDagentrunningonthefirewallmonitorsthesecurityeventlogs
forspecifiedMicrosoftExchangeServers,DomainControllers,orNovelleDirectoryserversforloginevents.
Forexample,inanADenvironment,youcanconfiguretheUserIDagenttomonitorthesecuritylogsfor
Kerberosticketgrantsorrenewals,Exchangeserveraccess(ifconfigured),andfileandprintservice
connections.Notethatfortheseeventstoberecordedinthesecuritylog,theADdomainmustbe
configuredtologsuccessfulaccountloginevents.Inaddition,becauseuserscanlogintoanyoftheservers
inthedomain,youmustsetupservermonitoringforallserverstocapturealluserloginevents.See
ConfigureUserMappingUsingtheWindowsUserIDAgentorConfigureUserMappingUsingthePANOS
IntegratedUserIDAgentfordetails.

PortMapping

InenvironmentswithmultiusersystemssuchasMicrosoftTerminalServerorCitrixenvironmentsmany
userssharethesameIPaddress.Inthiscase,theusertoIPaddressmappingprocessrequiresknowledgeof
thesourceportofeachclient.Toperformthistypeofmapping,youmustinstallthePaloAltoNetworks
TerminalServicesAgentontheWindows/Citrixterminalserveritselftointermediatetheassignmentof
sourceportstothevarioususerprocesses.ForterminalserversthatdonotsupporttheTerminalServices
agent,suchasLinuxterminalservers,youcanusetheXMLAPItosendusermappinginformationfromlogin
andlogouteventstoUserID.SeeConfigureUserMappingforTerminalServerUsersforconfiguration
details.

XFFHeaders

UserIDcanreadtheIPv4orIPv6addressesofusersfromtheXForwardedFor(XFF)headerinHTTPclient
requestswhenthefirewallisdeployedbetweentheInternetandaproxyserverthatwouldotherwisehide
theuserIPaddresses.UserIDmatchesthetrueuserIPaddresseswithusernames.SeeConfigurethe
firewalltoobtainuserIPaddressesfromXForwardedFor(XFF)headers.

AuthenticationPolicyandCaptivePortal

Insomecases,theUserIDagentcantmapanIPaddresstoausernameusingservermonitoringorother
methodsforexample,iftheuserisntloggedinorusesanoperatingsystemsuchasLinuxthatyourdomain
serversdontsupport.Inothercases,youmightwantuserstoauthenticatewhenaccessingsensitive
applicationsregardlessofwhichmethodstheUserIDagentusestoperformusermapping.Forallthese
cases,youcanconfigureConfigureAuthenticationPolicyandMapIPAddressestoUsernamesUsing
CaptivePortal.Anywebtraffic(HTTPorHTTPS)thatmatchesanAuthenticationpolicyrulepromptsthe
usertoauthenticatethroughCaptivePortal.YoucanusethefollowingCaptivePortalAuthentication
Methods:
BrowserchallengeUseKerberossinglesignon(recommended)orNTLANManager(NTLM)
authenticationifyouwanttoreducethenumberofloginpromptsthatusersmustrespondto.
WebformUseMultiFactorAuthentication,SAMLsinglesignon,Kerberos,TACACS+,RADIUS,LDAP,
orLocalAuthentication.
ClientCertificateAuthentication.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 411

Copyright 2007-2017 Palo Alto Networks

UserIDConcepts UserID

Syslog

Yourenvironmentmighthaveexistingnetworkservicesthatauthenticateusers.Theseservicesinclude
wirelesscontrollers,802.1xdevices,AppleOpenDirectoryservers,proxyservers,andotherNetwork
AccessControl(NAC)mechanisms.Youcanconfiguretheseservicestosendsyslogmessagesthatcontain
informationaboutloginandlogouteventsandconfiguretheUserIDagenttoparsethosemessages.The
UserIDagentparsesforlogineventstomapIPaddressestousernamesandparsesforlogouteventsto
deleteoutdatedmappings.DeletingoutdatedmappingsisparticularlyusefulinenvironmentswhereIP
addressassignmentschangeoften.
BoththePANOSintegratedUserIDagentandWindowsbasedUserIDagentuseSyslogParseprofilesto
parsesyslogmessages.Inenvironmentswhereservicessendthemessagesindifferentformats,youcan
createacustomprofileforeachformatandassociatemultipleprofileswitheachsyslogsender.Ifyouuse
thePANOSintegratedUserIDagent,youcanalsousepredefinedSyslogParseprofilesthatPaloAlto
NetworksprovidesthroughApplicationscontentupdates.
SyslogmessagesmustmeetthefollowingcriteriaforaUserIDagenttoparsethem:
Eachmessagemustbeasinglelinetextstring.Thealloweddelimitersforlinebreaksareanewline(\n)
oracarriagereturnplusanewline(\r\n).
Themaximumsizeforindividualmessagesis2,048bytes.
MessagessentoverUDPmustbecontainedinasinglepacket;messagessentoverSSLcanspanmultiple
packets.Asinglepacketmightcontainmultiplemessages.
SeeConfigureUserIDtoMonitorSyslogSendersforUserMappingforconfigurationdetails.

Figure:UserIDIntegrationwithSyslog

412 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID UserIDConcepts

GlobalProtect

Formobileorroamingusers,theGlobalProtectclientprovidestheusermappinginformationtothefirewall
directly.Inthiscase,everyGlobalProtectuserhasanagentorapprunningontheclientthatrequiresthe
usertoenterlogincredentialsforVPNaccesstothefirewall.Thislogininformationisthenaddedtothe
UserIDusermappingtableonthefirewallforvisibilityanduserbasedsecuritypolicyenforcement.Because
GlobalProtectusersmustauthenticatetogainaccesstothenetwork,theIPaddresstousernamemapping
isexplicitlyknown.Thisisthebestsolutioninsensitiveenvironmentswhereyoumustbecertainofwhoa
userisinordertoallowaccesstoanapplicationorservice.FormoreinformationonsettingupGlobalProtect,
refertotheGlobalProtectAdministratorsGuide.

XMLAPI

CaptivePortalandtheotherstandardusermappingmethodsmightnotworkforcertaintypesofuseraccess.
Forexample,thestandardmethodscannotaddmappingsofusersconnectingfromathirdpartyVPN
solutionorusersconnectingtoa802.1xenabledwirelessnetwork.Forsuchcases,youcanusethePANOS
XMLAPItocapturelogineventsandsendthemtothePANOSintegratedUserIDagent.SeeSendUser
MappingstoUserIDUsingtheXMLAPIfordetails.

ClientProbing

InaMicrosoftWindowsenvironment,youcanconfiguretheUserIDagenttoprobeclientsystemsusing
WindowsManagementInstrumentation(WMI)and/orNetBIOSprobingatregularintervalstoverifythatan
existingusermappingisstillvalidortoobtaintheusernameforanIPaddressthatisnotyetmapped.

NetBIOSprobingisonlysupportedontheWindowsbasedUserIDagent;itisnotsupportedonthePANOS
integratedUserIDagent.

ClientprobingwasdesignedforlegacynetworkswheremostuserswereonWindowsworkstationsonthe
internalnetwork,butisnotidealfortodaysmoremodernnetworksthatsupportaroamingandmobileuser
baseonavarietyofdevicesandoperatingsystems.Additionally,clientprobingcangeneratealargeamount
ofnetworktraffic(basedonthetotalnumberofmappedIPaddresses)andcanposeasecuritythreatwhen
misconfigured.Therefore,clientprobingisnolongerarecommendedmethodforusermapping.Instead
collectusermappinginformationfrommoreisolatedandtrustedsources,suchasdomaincontrollersand
throughintegrationswithSyslogortheXMLAPI,whichallowyoutosafelycaptureusermapping
informationfromanydevicetypeoroperatingsystem.Ifyouhavesensitiveapplicationsthatrequireyouto
knowexactlywhoauseris,configureAuthenticationPolicyandCaptivePortaltoensurethatyouareonly
allowingaccesstoauthorizedusers.

BecauseWMIprobingtrustsdatareportedbackfromtheendpoint,itisnotarecommendedmethodofobtaining
UserIDinformationinahighsecuritynetwork.IfyouareusingtheUserIDagenttoparseADsecurityevent
logs,syslogmessages,ortheXMLAPItoobtainUserIDmappings,PaloAltoNetworksrecommendsdisabling
WMIprobing.
IfyoudochoosetouseWMIprobing,donotenableitonexternal,untrustedinterfaces,asthiswouldcausethe
agenttosendWMIprobescontainingsensitiveinformationsuchastheusername,domainname,andpassword
hashoftheUserIDagentserviceaccountoutsideofyournetwork.Thisinformationcouldpotentiallybe
exploitedbyanattackertopenetratethenetworktogainfurtheraccess.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 413

Copyright 2007-2017 Palo Alto Networks

UserIDConcepts UserID

Ifyoudochoosetoenableprobinginyourtrustedzones,theagentwillprobeeachlearnedIPaddress
periodically(every20minutesbydefault,butthisisconfigurable)toverifythatthesameuserisstilllogged
in.Inaddition,whenthefirewallencountersanIPaddressforwhichithasnousermapping,itwillsendthe
addresstotheagentforanimmediateprobe.
SeeConfigureUserMappingUsingtheWindowsUserIDAgentorConfigureUserMappingUsingthe
PANOSIntegratedUserIDAgentfordetails.

414 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID EnableUserID

EnableUserID

Theuseridentity,asopposedtoanIPaddress,isanintegralcomponentofaneffectivesecurity
infrastructure.Knowingwhoisusingeachoftheapplicationsonyournetwork,andwhomayhave
transmittedathreatoristransferringfiles,canstrengthenyoursecuritypolicyandreduceincidentresponse
times.UserIDenablesyoutoleverageuserinformationstoredinawiderangeofrepositoriesforvisibility,
userandgroupbasedpolicycontrol,andimprovedlogging,reporting,andforensics:

ConfigureUserID

Step1 EnableUserIDonthesourcezonesthat 1. SelectNetwork > ZonesandclicktheNameofthezone.

containtheuserswhowillsendrequests 2. Enable User IdentificationandclickOK.
thatrequireuserbasedaccesscontrols.
EnableUserIDontrustedzones
only.IfyouenableUserIDand
clientprobingonanexternal
untrustedzone(suchasthe
internet),probescouldbesent
outsideyourprotectednetwork,
resultinginaninformation
disclosureoftheUserIDagent
serviceaccountname,domain
name,andencryptedpassword
hash,whichcouldallowan
attackertogainunauthorized
accesstoprotectedservicesand
applications.

Step2 CreateaDedicatedServiceAccountfor ThisisrequiredifyouplantousetheWindowsbasedUserID

theUserIDAgent. agentorthePANOSintegratedUserIDagenttomonitordomain
Asabestpractice,createa controllers,MicrosoftExchangeservers,orWindowsclientsfor
serviceaccountwiththe userloginandlogoutevents.
minimumsetofpermissions
requiredtosupporttheUserID
optionsyouenabletoreduce
yourattacksurfaceintheevent
thattheserviceaccountis
compromised.

Step3 MapUserstoGroups. ThisenablesthefirewalltoconnecttoyourLDAPdirectoryand

retrieveGroupMappinginformationsothatyouwillbeableto
selectusernamesandgroupnameswhencreatingpolicy.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 415

Copyright 2007-2017 Palo Alto Networks

EnableUserID UserID

ConfigureUserID(Continued)

Step4 MapIPAddressestoUsers. Thewayyoudothisdependsonwhereyourusersarelocatedand

Asabestpractice,donotenable
clientprobingasausermapping
methodonhighsecurity
networks.Clientprobingcan
generatealargeamountof
networktrafficandcanposea
securitythreatwhen
misconfigured.
whattypesofsystemstheyareusing,andwhatsystemsonyour
networkarecollectingloginandlogouteventsforyourusers.You
mustconfigureoneormoreUserIDagentstoenableUser
Mapping:
ConfigureUserMappingUsingtheWindowsUserIDAgent.
ConfigureUserMappingUsingthePANOSIntegratedUserID
Agent.
ConfigureUserIDtoMonitorSyslogSendersforUserMapping.
ConfigureUserMappingforTerminalServerUsers.
SendUserMappingstoUserIDUsingtheXMLAPI.

Step5 Specifythenetworkstoincludeand Configureeachagentthatyouconfiguredforusermappingas

excludefromusermapping. follows:
Asabestpractice,alwaysspecify SpecifythesubnetworkstheWindowsUserIDagentshould
whichnetworkstoincludeand includeinorexcludefromUserID.
excludefromUserID.This SpecifythesubnetworksthePANOSintegratedUserIDagent
allowsyoutoensurethatonly shouldincludeinorexcludefromusermapping.
yourtrustedassetsareprobed
andthatunwanteduser
mappingsarenotcreated
unexpectedly.

Step6 ConfigureAuthenticationPolicyand 1. ConfigureCaptivePortal.

CaptivePortal. 2. ConfigureAuthenticationPolicy.
ThefirewallusesCaptivePortalto
authenticateenduserswhenthey
requestservices,applications,orURL
categoriesthatmatchAuthentication
Policyrules.Basedonuserinformation
collectedduringauthentication,the
firewallcreatesnewusermappingsor
updatesexistingmappings.Themapping
informationcollectedduring
authenticationoverridesinformation
collectedthroughotherUserID
methods.

416 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
ConfigureUserID(Continued)
Step7 Enableuserandgroupbasedpolicy
enforcement.
Createrulesbasedongroup
ratherthanuserwhenever
possible.Thispreventsyoufrom
havingtocontinuallyupdateyour
rules(whichrequiresacommit)
wheneveryouruserbase
changes.
Step8 CreatetheSecuritypolicyrulestosafely
enableUserIDwithinyourtrustedzones
andpreventUserIDtrafficfrom
egressingyournetwork.
Step9 ConfigurethefirewalltoobtainuserIP 1.
addressesfromXForwardedFor(XFF)
headers.
Whenthefirewallisbetweenthe
Internetandaproxyserver,theIP
addressesinthepacketsthatthefirewall
seesarefortheproxyserverratherthan
users.ToenablevisibilityofuserIP
addressesinstead,configurethefirewall 3.
tousetheXFFheadersforusermapping.
Withthisoptionenabled,thefirewall
matchestheIPaddresseswith
usernamesreferencedinpolicytoenable
controlandvisibilityfortheassociated
usersandgroups.Fordetails,seeIdentify
UsersConnectedthroughaProxy
Server.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
EnableUserID
AfterconfiguringUserID,youwillbeabletochooseausername
orgroupnamewhendefiningthesourceordestinationofa
securityrule:
1. SelectPolicies > SecurityandAddanewruleorclickan
existingrulenametoedit.
2. SelectUserandspecifywhichusersandgroupstomatchin
theruleinoneofthefollowingways:
Ifyouwanttoselectspecificusersorgroupsasmatching
criteria,clickAddintheSourceUsersectiontodisplayalist
ofusersandgroupsdiscoveredbythefirewallgroup
mappingfunction.Selecttheusersorgroupstoaddtothe
rule.
Ifyouwanttomatchanyuserwhohasorhasnot
authenticatedandyoudontneedtoknowthespecificuser
orgroupname,selectknown-userorunknownfromthe
dropdownabovetheSourceUserlist.
3. ConfiguretherestoftheruleasappropriateandthenclickOK
tosaveit.Fordetailsonotherfieldsinthesecurityrule,see
SetUpaBasicSecurityPolicy.
FollowtheBestPracticeInternetGatewaySecurityPolicyto
ensurethattheUserIDapplication(paloaltouseridagent)isonly
allowedinthezoneswhereyouragents(bothyourWindows
agentsandyourPANOSintegratedagents)aremonitoring
servicesanddistributingmappingstofirewalls.Specifically:
Allowthepaloaltouseridagentapplicationbetweenthezones
whereyouragentsresideandthezoneswherethemonitored
serversreside(orevenbetter,betweenthespecificsystemsthat
hosttheagentandthemonitoredservers).
Allowthepaloaltouseridagentapplicationbetweentheagents
andthefirewallsthatneedtheusermappingsandbetween
firewallsthatareredistributingusermappingsandthefirewalls
theyareredistributingtheinformationto.
Denythepaloaltouseridagentapplicationtoanyexternal
zone,suchasyourinternetzone.
SelectDevice > Setup > Content-IDandeditthe
XForwardedForHeaderssettings.
2. SelectX-Forwarded-For Header in User-ID.
NOTE:SelectingStrip-X-Forwarded-For Headerdoesnt
disabletheuseofXFFheadersforuserattributioninpolicy
rules;thefirewallzeroesouttheXFFvalueonlyafterusingit
foruserattribution.
ClickOKtosaveyourchanges.
PANOS8.0AdministratorsGuide 417
EnableUserID UserID

ConfigureUserID(Continued)

Step10 Commityourchanges. Commityourchangestoactivatethem.

Step11 VerifytheUserIDConfiguration. Afteryouconfigureusermappingandgroupmapping,verifythat

theconfigurationworksproperlyandthatyoucansafelyenable
andmonitoruserandgroupaccesstoyourapplicationsand
services.

418 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID MapUserstoGroups

MapUserstoGroups

Definingpolicyrulesbasedonusergroupmembershipratherthanindividualuserssimplifiesadministration
becauseyoudonthavetoupdatetheruleswhenevergroupmembershipchanges.Thenumberofdistinct
usergroupsthateachfirewallorPanoramacanreferenceacrossallpoliciesvariesbymodel:
VM50,VM100,VM300,PA200,PA220,PA500,PA800Series,PA3020,andPA3050firewalls:
1,000groups
VM500,VM700,PA5020,PA5050,PA5060,PA5200Series,andPA7000Seriesfirewalls,andall
Panoramamodels:10,000groups
UsethefollowingproceduretoenablethefirewalltoconnecttoyourLDAPdirectoryandretrieveGroup
Mappinginformation.YoucanthenEnableUserandGroupBasedPolicy.

ThefollowingarebestpracticesforgroupmappinginanActiveDirectory(AD)environment:
Ifyouhaveasingledomain,youneedonlyonegroupmappingconfigurationwithanLDAPserverprofile
thatconnectsthefirewalltothedomaincontrollerwiththebestconnectivity.Youcanadduptofour
domaincontrollerstotheLDAPserverprofileforfaulttolerance.Notethatyoucannotincrease
redundancybeyondfourdomaincontrollersforasingledomainbyaddingmultiplegroupmapping
configurationsforthatdomain.
Ifyouhavemultipledomainsand/ormultipleforests,youmustcreateagroupmappingconfiguration
withanLDAPserverprofilethatconnectsthefirewalltoadomainserverineachdomain/forest.Take
stepstoensureuniqueusernamesinseparateforests.
IfyouhaveUniversalGroups,createanLDAPserverprofiletoconnecttotheGlobalCatalogserver.

MapUserstoGroups

Step1 AddanLDAPserverprofile. 1. SelectDevice > Server Profiles > LDAPandAddaserver

Theprofiledefineshowthefirewall
connectstothedirectoryserversfrom
whichitcollectsgroupmapping
information.
profile.
2. EnteraProfile Nametoidentifytheserverprofile.
3. AddtheLDAPservers.Youcanadduptofourserverstothe
profilebuttheymustbethesameType.Foreachserver,enter
aName(toidentifytheserver),LDAP ServerIPaddressor
FQDN,andserverPort(default389).
4. SelecttheserverType.
Basedonyourselection(suchasactive-directory),thefirewall
automaticallypopulatesthecorrectLDAPattributesinthe
groupmappingsettings.However,ifyoucustomizedyour
LDAPschema,youmightneedtomodifythedefaultsettings.
5. FortheBase DN,entertheDistinguishedName(DN)ofthe
LDAPtreelocationwhereyouwantthefirewalltostart
searchingforuserandgroupinformation.
6. FortheBind DN,PasswordandConfirm Password,enterthe
authenticationcredentialsforbindingtotheLDAPtree.
TheBind DNcanbeafullyqualifiedLDAPname(suchas
cn=administrator,cn=users,dc=acme,dc=local)orauser
principalname(suchasadministrator@acme.local).
7. EntertheBind TimeoutandSearch Timeoutinseconds
(defaultis30forboth).
8. ClickOKtosavetheserverprofile.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 419

Copyright 2007-2017 Palo Alto Networks

MapUserstoGroups
MapUserstoGroups(Continued)
Step2 Configuretheserversettingsinagroup 1.
mappingconfiguration.
420 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
SelectDevice > User Identification > Group Mapping Settings.
2. Addthegroupmappingconfiguration.
3. EnterauniqueNametoidentifythegroupmapping
configuration.
4. SelecttheLDAPServer Profileyoujustcreated.
5. (Optional)Bydefault,theUser Domainfieldisblank:the
firewallautomaticallydetectsthedomainnamesforActive
Directory(AD)servers.Ifyouenteravalue,itoverridesany
domainnamesthatthefirewallretrievesfromtheLDAP
source.YourentrymustbetheNetBIOSdomainname.
6. (Optional)Tofilterthegroupsthatthefirewalltracksfor
groupmapping,intheGroupObjectssection,enteraSearch
Filter(LDAPquery),Object Class(groupdefinition),Group
Name,andGroup Member.
7. (Optional)Tofiltertheusersthatthefirewalltracksforgroup
mapping,intheUserObjectssection,enteraSearch Filter
(LDAPquery),Object Class(userdefinition),andUser Name.
8. (Optional)TomatchUserIDinformationwithemailheader
informationidentifiedinthelinksandattachmentsofemails
forwardedtoWildFire,enterthelistofemaildomains
(Domain List)inyourorganization.Usecommastoseparate
multipledomains(upto256characters).
AfteryouclickOK(laterinthisprocedure),PANOS
automaticallypopulatestheMail Attributesbasedonthetype
ofLDAPserverspecifiedintheServer Profile.Whenamatch
occurs,theusernameintheWildFirelogemailheadersection
willcontainalinkthatopenstheACCtab,filteredbyuseror
usergroup.
9. MakesurethegroupmappingconfigurationisEnabled
(defaultisenabled).
PaloAltoNetworks,Inc.
UserID
MapUserstoGroups(Continued)
Step3 Limitwhichgroupswillbeavailablein
policyrules.
Requiredonlyifyouwanttolimitpolicy
rulestospecificgroups.Thecombined
maximumfortheGroup Include Listand
Custom Grouplistis640entriesper
groupmappingconfiguration.Eachentry
canbeasinglegrouporalistofgroups.
Bydefault,ifyoudontspecifygroups,all
groupsareavailableinpolicyrules.
Anycustomgroupsyoucreate
willalsobeavailableintheAllow
Listofauthenticationprofiles
(ConfigureanAuthentication
ProfileandSequence).
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapUserstoGroups
1. Addexistinggroupsfromthedirectoryservice:
a. SelectGroup Include List.
b. SelecttheAvailableGroupsyouwanttoappearinpolicy
rulesandadd( )themtotheIncludedGroups.
2. Ifyouwanttobasepolicyrulesonuserattributesthatdont
matchexistingusergroups,createcustomgroupsbasedon
LDAPfilters:
a. SelectCustom GroupandAddthegroup.
b. EnteragroupName thatisuniqueinthegroupmapping
configurationforthecurrentfirewallorvirtualsystem.
IftheNamehasthesamevalueastheDistinguishedName
(DN)ofanexistingADgroupdomain,thefirewallusesthe
customgroupinallreferencestothatname(suchasin
policiesandlogs).
c. SpecifyanLDAP Filterofupto2,048UTF8characters
andclickOK.
ThefirewalldoesntvalidateLDAPfilters,soitsuptoyou
toensuretheyareaccurate.
TominimizetheperformanceimpactontheLDAP
directoryserver,useonlyindexedattributesinthe
filter.
3. ClickOKandCommit.
Acommitisnecessarybeforecustomgroupswillbeavailable
inpoliciesandobjects.
PANOS8.0AdministratorsGuide 421
MapIPAddressestoUsers UserID

MapIPAddressestoUsers

UserIDprovidesmanydifferentmethodsformappingIPaddressestousernames.Beforeyoubegin
configuringusermapping,considerwhereyourusersarelogginginfrom,whatservicestheyareaccessing,
andwhatapplicationsanddatayouneedtocontrolaccessto.Thiswillinformwhichtypesofagentsor
integrationswouldbestallowyoutoidentifyyourusers.Forguidance,refertoArchitectingUser
IdentificationDeployments.
Onceyouhaveyourplan,youcanbeginconfiguringusermappingusingoneormoreofthefollowing
methodsasneededtoenableuserbasedaccessandvisibilitytoapplicationsandresources:
TomapusersastheylogintoyourExchangeservers,domaincontrollers,eDirectoryservers,or
WindowsclientsyoumustconfigureaUserIDagent:
ConfigureUserMappingUsingthePANOSIntegratedUserIDAgent
ConfigureUserMappingUsingtheWindowsUserIDAgent
IfyouhaveclientsrunningmultiusersystemsinaWindowsenvironment,suchasMicrosoftTerminal
ServerorCitrixMetaframePresentationServerorXenApp,ConfigurethePaloAltoNetworksTerminal
ServicesAgentforUserMapping.ForamultiusersystemthatdoesntrunonWindows,youcan
RetrieveUserMappingsfromaTerminalServerUsingthePANOSXMLAPI.
Toobtainusermappingsfromexistingnetworkservicesthatauthenticateuserssuchaswireless
controllers,802.1xdevices,AppleOpenDirectoryservers,proxyservers,orotherNetworkAccess
Control(NAC)mechanismsConfigureUserIDtoMonitorSyslogSendersforUserMapping.
WhileyoucanconfigureeithertheWindowsagentorthePANOSintegratedUserIDagenton
thefirewalltolistenforauthenticationsyslogmessagesfromthenetworkservices,becauseonly
thePANOSintegratedagentsupportssysloglisteningoverTLS,itisthepreferredconfiguration.
Ifyouhaveuserswithclientsystemsthatarentloggedintoyourdomainserversforexample,users
runningLinuxclientsthatdontlogintothedomainyoucanMapIPAddressestoUsernamesUsing
CaptivePortal.UsingCaptivePortalinconjunctionwithAuthenticationPolicyalsoensuresthatallusers
authenticatetoaccessyourmostsensitiveapplicationsanddata.
Forotherclientsthatyoucantmapusingtheothermethods,youcanSendUserMappingstoUserID
UsingtheXMLAPI.
Alargescalenetworkcanhavehundredsofinformationsourcesthatfirewallsqueryforuserandgroup
mappingandcanhavenumerousfirewallsthatenforcepoliciesbasedonthemappinginformation.You
cansimplifyUserIDadministrationforsuchanetworkbyaggregatingthemappinginformationbefore
theUserIDagentscollectit.Youcanalsoreducetheresourcesthatthefirewallsandinformation
sourcesuseinthequeryingprocessbyconfiguringsomefirewallstoredistributethemapping
information.Fordetails,seeDeployUserIDinaLargeScaleNetwork.

422 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID MapIPAddressestoUsers

CreateaDedicatedServiceAccountfortheUserIDAgent

IfyouplantouseeithertheWindowsbasedUserIDagentorthePANOSintegratedUserIDagenttomap
usersastheylogintoyourExchangeservers,domaincontrollers,eDirectoryservers,orWindowsclients,
youmustcreateadedicatedserviceaccountfortheUserIDagentonadomaincontrollerineachdomain
thattheagentwillmonitor.
Therequiredpermissionsfortheserviceaccountdependonwhatusermappingmethodsandsettingsyou
plantouse.ToreducetheriskassociatedwithcompromiseoftheUserIDserviceaccount,alwaysconfigure
theaccountwiththeminimumsetofpermissionsnecessaryfortheagenttofunctionproperly.

UserIDprovidesmanymethodsforsafelycollectingusermappinginformation.Someofthelegacyfeatures,
whichweredesignedforenvironmentsthatonlyrequiredmappingofusersonWindowsdesktopsattachedto
thelocalnetwork,requireprivilegedserviceaccounts.Intheeventthattheprivilegedserviceaccountis
compromised,thiswouldopenyournetworktoattack.Asabestpractice,avoidusingtheselegacyfeaturessuch
asclientprobing,NTLMauthentication,andsessionmonitoringthatrequireprivilegesthatwouldposeathreat
ifcompromised.ThefollowingworkflowdetailsallprivilegesrequiredandprovideguidanceastowhichUserID
featuresrequireprivilegesthatcouldposeathreatsothatyoucandecidehowtobestidentifyuserswithout
compromisingyouroverallsecurityposture.

CreateaDedicatedServiceAccountfortheUserIDAgent

Step1 CreateanADaccountfortheUserID 1. Logintothedomaincontroller.

agent. 2. RightclicktheWindowsicon(
),SearchforActive
Youmustcreateaserviceaccountin Directory Users and Computers,andlaunchthe
eachdomaintheagentwillmonitor. application.
3. Inthenavigationpane,openthedomaintree,rightclick
Managed Service AccountsandselectNew > User.
4. EntertheFirst Name,Last Name,andUser logon nameofthe
userandclickNext.
5. EnterthePasswordandConfirm Password,andthenclick
NextandFinish.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 423

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers
CreateaDedicatedServiceAccountfortheUserIDAgent(Continued)
Step2 AddtheaccounttotheBuiltingroups 1.
thathaveprivilegesforaccessingthe
servicesandhoststheUserIDagentwill 2.
monitor.
424 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
RightclicktheserviceaccountyoujustaddedandAdd to a
group.
Enter the object names to selectasfollowstoassignthe
accounttogroups.Separateeachentrywithasemicolon.
Event Log Readersoracustomgroupthathasprivileges
forreadingSecuritylogevents.Theseprivilegesare
requirediftheUserIDagentwillcollectmapping
informationbymonitoringSecuritylogs.
(PANOSintegratedagentonly)Distributed COM Users
group,whichhasprivilegesforlaunching,activating,and
usingDistributedComponentObjectModel(DCOM)
objects.
(Notrecommended) Server Operatorsgroup,whichhas
privilegesforopeningsessions.Theagentonlyrequires
theseprivilegesifyouplantoconfigureittorefreshexisting
mappinginformationbymonitoringusersessions.
Becausethisgroupalsohasprivilegesforshutting
downandrestartingservers,assigntheaccountto
itonlyifmonitoringusersessionsisveryimportant.
(PANOSintegratedagentonly)Ifyouplantoconfigure
NTLMauthenticationforCaptivePortal,thefirewallwhere
youveconfiguredtheagentwillneedtojointhedomain.To
enablethis,enterthenameofagroupthathas
administrativeprivilegestojointhedomain,writetothe
validatedserviceprincipalname,andcreateacomputer
objectwithinthecomputersorganizationunit
(ou=computers).
ThePANOSintegratedagentrequiresprivileged
operationstojointhedomain,whichposesa
securitythreatiftheaccountiscompromised.
ConsiderconfiguringKerberossinglesignon(SSO)
orSAMLSSOauthenticationforCaptivePortal
insteadofNTLM.KerberosandSAMLarestronger,
moresecureauthenticationmethodsanddonot
requirethefirewalltojointhedomain.
Forafirewallwithmultiplevirtualsystems,onlyvsys1can
jointhedomainbecauseofADrestrictionsonvirtual
systemsrunningonthesamehost.
3. Check NamestovalidateyourentriesandclickOKtwice.
PaloAltoNetworks,Inc.
UserID MapIPAddressestoUsers

CreateaDedicatedServiceAccountfortheUserIDAgent(Continued)

Step3 IfyouplantouseWMIprobing,enable PerformthistaskoneachclientsystemthattheUserIDagentwill

theaccounttoreadtheCIMV2
namespaceontheclientsystems.
Bydefault,accountsintheServer
Operatorsgrouphavethispermission.
Donotenableclientprobingon
highsecuritynetworks.Client
probingcangeneratealarge
amountofnetworktrafficand
canposeasecuritythreatwhen
misconfigured.Insteadcollect
usermappinginformationfrom
moreisolatedandtrusted
sources,suchasdomain
controllersandthrough
integrationswithSyslogorthe
XMLAPI,whichhavetheadded
benefitofallowingyoutosafely
captureusermapping
informationfromanydevicetype
oroperatingsystem,insteadof
justWindowsclients.
probeforusermappinginformation:
1. RightclicktheWindowsicon( ),Searchforwmimgmt.msc,
andlaunchtheWMIManagementConsole.
2. Intheconsoletree,rightclickWMI Controlandselect
Properties.
3. SelectSecurity,selectRoot > CIMV2,andclickSecurity.
4. Addthenameoftheserviceaccountyoucreated,Check
Namestoverifyyourentry,andclickOK.
YoumighthavetochangetheLocationsorclick
Advancedtoqueryforaccountnames.Seethedialog
helpfordetails.
5. InthePermissionsfor<Username>section,AllowtheEnable
Account,Read Security,andRemote Enablepermissions.
6. ClickOKtwice.

Step4 Turnoffaccountprivilegesthatarenot ToensurethattheUserIDaccounthastheminimumprivileges

necessary.
ByensuringthattheUserIDservice
accounthastheminimumsetofaccount
privileges,youcanreducetheattack
surfaceshouldtheaccountbe
compromised.
necessary,denythefollowingprivilegesontheaccount:
DenyinteractivelogonfortheUserIDserviceaccountWhile
theUserIDserviceaccountdoesneedpermissiontoreadand
parseActiveDirectorysecurityeventlogs,itdoesnotrequire
theabilitytologontoserversordomainsystemsinteractively.
YoucanrestrictthisprivilegeusingGroupPoliciesorbyusinga
ManagedServiceaccount(refertoMicrosoftTechNetformore
information).
DenyremoteaccessfortheUserIDserviceaccountThis
preventsanattackerfromusingtheaccounttoaccessyour
networkfromtheoutsidethenetwork.

Step5 Nextsteps... Youarenowreadyto:

ConfigureUserMappingUsingtheWindowsUserIDAgent.
ConfigureUserMappingUsingthePANOSIntegratedUserID
Agent.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 425

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

ConfigureUserMappingUsingtheWindowsUserIDAgent

Inmostcases,themajorityofyournetworkuserswillhaveloginstoyourmonitoreddomainservices.For
theseusers,thePaloAltoNetworksUserIDagentmonitorstheserversforlogineventsandperformsthe
IPaddresstousernamemapping.ThewayyouconfiguretheUserIDagentdependsonthesizeofyour
environmentandthelocationofyourdomainservers.Asabestpractice,locateyourUserIDagentsnear
theserversitwillmonitor(thatis,themonitoredserversandtheWindowsUserIDagentshouldnotbe
acrossaWANlinkfromeachother).Thisisbecausemostofthetrafficforusermappingoccursbetweenthe
agentandthemonitoredserver,withonlyasmallamountoftrafficthedeltaofusermappingssincethe
lastupdatefromtheagenttothefirewall.
ThefollowingtopicsdescribehowtoinstallandconfiguretheUserIDAgentandhowtoconfigurethe
firewalltoretrieveusermappinginformationfromtheagent:
InstalltheWindowsBasedUserIDAgent
ConfiguretheWindowsBasedUserIDAgentforUserMapping

InstalltheWindowsBasedUserIDAgent

ThefollowingprocedureshowshowtoinstalltheUserIDagentonamemberserverinthedomainandset
uptheserviceaccountwiththerequiredpermissions.Ifyouareupgrading,theinstallerwillautomatically
removetheolderversion,however,itisagoodideatobackuptheconfig.xmlfilebeforerunningtheinstaller.

ForinformationaboutthesystemrequirementsforinstallingtheWindowsbasedUserIDagent
andforinformationonsupportedserverOSversions,refertothePaloAltoNetworks
CompatibilityMatrix.

InstalltheWindowsUserIDAgent

Step1 CreateadedicatedActiveDirectory CreateaDedicatedServiceAccountfortheUserIDAgent.

serviceaccountfortheUserIDagentto
accesstheservicesandhostsitwill
monitortocollectusermappings.

Step2 DecidewheretoinstalltheUserID YoumustinstalltheUserIDagentonasystemrunningoneof

agent.
TheUserIDagentqueriestheDomain
ControllerandExchangeserverlogs
usingMicrosoftRemoteProcedureCalls
(MSRPCs),whichrequireacomplete
transferoftheentirelogateachquery.
Therefore,alwaysinstalloneormore
UserIDagentsateachsitethathas
serverstobemonitored.
NOTE:Formoredetailedinformationon
wheretoinstallUserIDagents,referto
ArchitectingUserIdentification
(UserID)Deployments.
thesupportedOSversions:seeOperatingSystem(OS)
CompatibilityUserIDAgentintheUserIDAgentRelease
Notes.
MakesurethesystemthatwillhosttheUserIDagentisa
memberofthesamedomainastheserversitwillmonitor.
Asabestpractice,installtheUserIDagentclosetotheservers
itwillbemonitoring(thereismoretrafficbetweentheUserID
agentandthemonitoredserversthanthereisbetweenthe
UserIDagentandthefirewall,solocatingtheagentclosetothe
monitoredserversoptimizesbandwidthusage).
Toensurethemostcomprehensivemappingofusers,youmust
monitorallserversthatcontainuserlogininformation.Youmight
needtoinstallmultipleUserIDagentstoefficientlymonitorall
ofyourresources.

426 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
InstalltheWindowsUserIDAgent(Continued)
Step3 DownloadtheUserIDagentinstaller.
InstalltheUserIDagentversion
thatisthesameasthePANOS
versionrunningonthefirewalls.
IfthereisnotaUserIDagent
versionthatmatchesthe
PANOSversion,installthe
latestversionthatisclosestto
thePANOSversion.For
example,ifyouarerunning
PANOS7.1onyourfirewalls,
installUserIDagentversion7.0.
Step4 Runtheinstallerasanadministrator.
Step5 LaunchtheUserIDAgentapplication.
Step6 (Optional)Changetheserviceaccount
thattheUserIDagentusestologin.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
1. LogintothePaloAltoNetworksCustomerSupportwebsite.
2. SelectSoftware UpdatesfromtheManageDevicessection.
3. ScrolltotheUserIdentificationAgentsectionofthescreen
andDownloadtheversionoftheUserIDagentyouwantto
install.
4. SavetheUaInstall-x.x.x-xx.msifileonthesystem(s)
whereyouplantoinstalltheagent.
1. OpentheWindowsStartmenu,rightclicktheCommand
Promptprogram,andselectRun as administrator.
2. Fromthecommandline,runthe.msifileyoudownloaded.For
example,ifyousavedthe.msifiletotheDesktopyouwould
enterthefollowing:
C:\Users\administrator.acme>cd Desktop
C:\Users\administrator.acme\Desktop>UaInstall-6.0.
0-1.msi
3. Followthesetuppromptstoinstalltheagentusingthedefault
settings.Bydefault,theagentgetsinstalledtotheC:\Program
Files (x86)\Palo Alto Networks\User-ID Agentfolder,
butyoucanBrowsetoadifferentlocation.
4. Whentheinstallationcompletes,Closethesetupwindow.
OpentheWindowsStartmenuandselectUser-ID Agent.
Bydefault,theagentusestheadministratoraccountusedtoinstall
the.msifile.However,youmaywanttoswitchthistoarestricted
accountasfollows:
1. SelectUser Identification > SetupandclickEdit.
2. SelecttheAuthenticationtabandentertheserviceaccount
namethatyouwanttheUserIDagenttouseintheUser
name for Active Directoryfield.
3. EnterthePasswordforthespecifiedaccount.
PANOS8.0AdministratorsGuide 427
MapIPAddressestoUsers
InstalltheWindowsUserIDAgent(Continued)
Step7 (Optional)Assignaccountpermissionsto 1.
theinstallationfolder.
Youonlyneedtoperformthisstepifthe
serviceaccountyouconfiguredforthe
UserIDagentisnotamemberofthe
administratorsgroupforthedomainora
memberofboththeServerOperators
andtheEventLogReadersgroups.
428 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
Givetheserviceaccountpermissionstotheinstallationfolder:
a. FromtheWindowsExplorer,navigatetoC:\Program
Files\Palo Alto Networksandrightclickthefolderand
selectProperties.
b. OntheSecuritytab,AddtheUserIDagentserviceaccount
andassignitpermissionstoModify,Read & execute,List
folder contents,andReadandthenclickOKtosavethe
accountsettings.
2. GivetheserviceaccountpermissionstotheUserIDAgent
registrysubtree:
a. Runregedit32andnavigatetothePaloAltoNetworks
subtreeinoneofthefollowinglocations:
32bitsystemsHKEY_LOCAL_MACHINE\Software\ Palo
Alto Networks
64bitsystemsHKEY_LOCAL_MACHINE\Software\
WOW6432Node\Palo Alto Networks
b. RightclickthePaloAltoNetworksnodeandselect
Permissions.
c. AssigntheUserIDserviceaccountFull Controlandthen
clickOKtosavethesetting.
3. Onthedomaincontroller,addtheserviceaccounttothe
builtingroupstoenableprivilegestoreadthesecuritylog
events(EventLogReadergroup)andopensessions(Server
Operatorgroup):
a. RuntheMMCandLaunchtheActiveDirectoryUsersand
Computerssnapin.
b. NavigatetotheBuiltinfolderforthedomainandthen
rightclickeachgroupyouneedtoedit(EventLogReader
andServerOperator)andselectAdd to Grouptoopenthe
propertiesdialog.
c. ClickAddandenterthenameoftheserviceaccountthat
youconfiguredtheUserIDservicetouseandthenclick
Check Namestovalidatethatyouhavetheproperobject
name.
d. ClickOKtwicetosavethesettings.
PaloAltoNetworks,Inc.
UserID
InstalltheWindowsUserIDAgent(Continued)
Step8 (Optional)Assignyourowncertificates 1.
formutualauthenticationbetweenthe
WindowsUserIDagentandthefirewall.
Step9 ConfigureCredentialDetectionwiththeWindowsbasedUserIDAgent.
TousetheWindowsbasedUserIDagenttodetectcredentialsubmissionsandPreventCredentialPhishing,
youmustinstalltheUserIDcredentialserviceontheWindowsbasedUserIDagent.Youcanonlyinstallthis
addononareadonlydomaincontroller(RODC).
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
ObtainyourcertificatefortheWindowsUserIDagent.The
Privatekeyoftheservercertificatemustbeencryptedand
uploadedusingthePFXorP12bundles.
GenerateaCertificateandexportitforuploadtothe
WindowsUserIDagent.
Exportacertificatefromyourenterprisecertificate
authority(CA)andtheuploadittotheWindowsUserID
agent.
2. AddaservercertificatetoWindowsUserIDagent.
a. OntheWindowsUserIDagent,selectServer Certificate
andclickAdd.
b. Enterthepathandnameofthecertificatefilereceivedfrom
theCAorbrowsetothecertificatefile.
c. Entertheprivatekeypassword.
d. ClickOKandthenCommit.
3. UploadacertificatetothefirewalltovalidatetheWindows
UserIDagentsidentity.
4. Configurethecertificateprofilefortheclientdevice.The
clientdevice(firewallorPanorama)
a. SelectDevice > Certificate Management > Certificate
Profile.
b. ConfigureaCertificateProfile.
Youcanonlyassignonecertificateprofilefor
WindowsUserIDagentsandTerminalServices(TS)
agents.Therefore,yourcertificateprofilemust
includeallcertificateauthoritiesthatissued
certificatesuploadedtoconnectedUserIDandTS
agents.
5. Assignthecertificateprofileonthefirewall.
a. SelectDevice > User Identification > Connection Security
andclicktheeditbutton.
b. Selectthecertificateprofileyouconfiguredintheprevious
stepfromtheUserIDCertificateProfiledropdown.
c. ClickOK.
6. Commityourchanges.
PANOS8.0AdministratorsGuide 429
MapIPAddressestoUsers UserID

ConfiguretheWindowsBasedUserIDAgentforUserMapping

ThePaloAltoNetworksUserIDagentisaWindowsservicethatconnectstoserversonyournetworkfor
example,ActiveDirectoryservers,MicrosoftExchangeservers,andNovelleDirectoryserversand
monitorsthelogsforloginevents.TheagentusesthisinformationtomapIPaddressestousernames.Palo
AltoNetworksfirewallsconnecttotheUserIDagenttoretrievethisusermappinginformation,enabling
visibilityintouseractivitybyusernameratherthanIPaddressandenablesuserandgroupbasedsecurity
enforcement.

ForinformationabouttheserverOSversionssupportedbytheUserIDagent,refertoOperating
System(OS)CompatibilityUserIDAgentintheUserIDAgentReleaseNotes.

MAPIPADDRESSESTOUSERSUSINGTHEWINDOWSBASEDUSERIDAGENT

Step1 DefinetheserverstheUserIDagent 1. OpentheWindowsStartmenuandselectUser-ID Agent.

willmonitortocollectIPaddresstouser
mappinginformation.
TheUserIDagentcanmonitorupto100
servers,ofwhichupto50canbesyslog
senders.
NOTE:Tocollectalloftherequired
mappings,theUserIDagentmust
connecttoallserversthatyouruserslog
intoinordertomonitorthesecuritylog
filesonallserversthatcontainlogin
events.
2. SelectUser Identification > Discovery.
3. IntheServerssectionofthescreen,clickAdd.
4. EnteraNameandServer Addressfortheservertobe
monitored.ThenetworkaddresscanbeaFQDNoranIP
address.
5. SelecttheServer Type(Microsoft Active Directory,Microsoft
Exchange,Novell eDirectory,orSyslog Sender)andthen
clickOKtosavetheserverentry.Repeatthisstepforeach
servertobemonitored.
6. (Optional)Toenablethefirewalltoautomaticallydiscover
domaincontrollersonyournetworkusingDNSlookups,click
Auto Discover.
NOTE:Autodiscoverylocatesdomaincontrollersinthelocal
domainonly;youmustmanuallyaddExchangeservers,
eDirectoryservers,andsyslogsenders.
7. (Optional)Totunethefrequencyatwhichthefirewallpolls
configuredserversformappinginformation,selectUser
Identification > SetupandEdittheSetupsection.Onthe
Server Monitortab,modifythevalueintheServer Log
Monitor Frequency (seconds)field.Increasethevalueinthis
fieldto5secondsinenvironmentswitholderDomain
Controllersorhighlatencylinks.
EnsurethattheEnable Server Session Readsettingis
notselected.ThissettingrequiresthattheUserID
agenthaveanActiveDirectoryaccountwithServer
Operatorprivilegessothatitcanreadallusersessions.
Instead,useasyslogorXMLAPIintegrationto
monitorsourcesthatcaptureloginandlogoutevents
foralldevicetypesandoperatingsystems(insteadof
justWindows),suchaswirelesscontrollersand
NetworkAccessControllers(NACs).
8. ClickOKtosavethesettings.

430 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
MAPIPADDRESSESTOUSERSUSINGTHEWINDOWSBASEDUSERIDAGENT(Continued)
Step2 SpecifythesubnetworkstheWindows 1.
UserIDagentshouldincludeinor 2.
excludefromUserID.
Bydefault,theUserIDmapsallusers
accessingtheserversyouaremonitoring.
Asabestpractice,alwaysspecify
whichnetworkstoincludeand
excludefromUserIDtoensure
thattheagentisonly
communicatingwithinternal
resourcesandtoprevent
unauthorizedusersfrombeing
mapped.Youshouldonlyenable
UserIDonthesubnetworks
whereusersinternaltoyour
organizationareloggingin.
Step3 (Optional)Ifyouconfiguredtheagentto 1.
connecttoaNovelleDirectoryserver,
youmustspecifyhowtheagentshould 2.
searchthedirectory.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
SelectUser Identification > Discovery.
AddanentrytotheInclude/Excludelistofconfigured
networksandenteraNamefortheentryandentertheIP
addressrangeofthesubnetworkinastheNetwork Address.
3. Selectwhethertoincludeorexcludethenetwork:
Include specified networkSelectthisoptionifyouwant
tolimitusermappingtousersloggedintothespecified
subnetworkonly.Forexample,ifyouinclude10.0.0.0/8,
theagentmapstheusersonthatsubnetworkandexcludes
allothers.Ifyouwanttheagenttomapusersinother
subnetworks,youmustrepeatthesestepstoaddadditional
networkstothelist.
Exclude specified networkSelectthisoptiononlyifyou
wanttheagenttoexcludeasubsetofthesubnetworksyou
addedforinclusion.Forexample,ifyouinclude10.0.0.0/8
andexclude10.2.50.0/22,theagentwillmapusersonall
thesubnetworksof10.0.0.0/8except10.2.50.0/22,and
willexcludeallsubnetworksoutsideof10.0.0.0/8.
Ifyouaddsubnetworksforexclusionwithout
addinganyforinclusion,theagentwillnotperform
usermappinginanysubnetwork.
4. ClickOK.
SelectUser Identification > SetupandclickEditintheSetup
sectionofthewindow.
SelecttheeDirectorytabandthencompletethefollowing
fields:
Search BaseThestartingpointorrootcontextforagent
queries,forexample:dc=domain1, dc=example, dc=com.
Bind Distinguished NameTheaccounttousetobindto
thedirectory,forexample:cn=admin, ou=IT,
dc=domain1, dc=example, dc=com.
Bind PasswordThebindaccountpassword.Theagent
savestheencryptedpasswordintheconfigurationfile.
Search FilterThesearchqueryforuserentries(defaultis
objectClass=Person).
Server Domain PrefixAprefixtouniquelyidentifythe
user.Thisisonlyrequiredifthereareoverlappingname
spaces,suchasdifferentuserswiththesamenamefrom
twodifferentdirectories.
Use SSLSelectthecheckboxtouseSSLforeDirectory
binding.
Verify Server CertificateSelectthecheckboxtoverify
theeDirectoryservercertificatewhenusingSSL.
PANOS8.0AdministratorsGuide 431
MapIPAddressestoUsers
MAPIPADDRESSESTOUSERSUSINGTHEWINDOWSBASEDUSERIDAGENT(Continued)
Step4 (Optional,notrecommended)Configure 1.
clientprobing.
Donotenableclientprobingon 2.
highsecuritynetworks.Client
probingcangeneratealarge
amountofnetworktrafficand
canposeasecuritythreatwhen
misconfigured.
Step5 Savetheconfiguration.
Step6 (Optional)Definethesetofusersfor
whichyoudonotneedtoprovideIP
addresstousernamemappings,suchas
kioskaccounts.
Youcanalsousethe
ignore-userlisttoidentify
userswhomyouwanttoforceto
authenticateusingCaptive
Portal.
Step7 Configurethefirewalltoconnecttothe
UserIDagent.
NOTE:Thefirewallcanconnecttoonly
oneWindowsbasedUserIDagentthat
isusingtheUserIDcredentialservice
addontodetectcorporatecredential
submissions.SeeConfigureCredential
DetectionwiththeWindowsbased
UserIDAgentformoredetailsonhow
tousethisserviceforcredentialphishing
prevention.
432 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
OntheClient Probingtab,selecttheEnable WMI Probing
checkboxand/ortheEnable NetBIOS Probingcheckbox.
MakesuretheWindowsfirewallwillallowclientprobingby
addingaremoteadministrationexceptiontotheWindows
firewallforeachprobedclient.
NOTE:ForNetBIOSprobingtoworkeffectively,eachprobed
clientPCmustallowport139intheWindowsfirewalland
mustalsohavefileandprintersharingservicesenabled.
Althoughclientprobingisnotrecommended,ifyouplanto
enableit,WMIprobingispreferredoverNetBIOSwhenever
possible.
ClickOKtosavetheUserIDagentsetupsettingsandthenclick
CommittorestarttheUserIDagentandloadthenewsettings.
Createanignore_user_list.txtfileandsaveittotheUserID
Agentfolderonthedomainserverwheretheagentisinstalled.
Listtheuseraccountstoignore;thereisnolimittothenumberof
accountsyoucanaddtothelist.Eachuseraccountnamemustbe
onaseparateline.Forexample:
SPAdmin
SPInstall
TFSReport
Youcanuseanasteriskasawildcardcharactertomatchmultiple
usernames,butonlyasthelastcharacterintheentry.Forexample,
corpdomain\it-admin*wouldmatchalladministratorsinthe
corpdomaindomainwhoseusernamesstartwiththestring
it-admin.
Completethefollowingstepsoneachfirewallyouwanttoconnect
totheUserIDagenttoreceiveusermappings:
1. SelectDevice > User Identification > User-ID Agentsandclick
Add.
2. EnteraNamefortheUserIDagent.
3. EntertheIPaddressoftheWindowsHostonwhichthe
UserIDAgentisinstalled.
4. EnterthePortnumber(165535)onwhichtheagentwill
listenforusermappingrequests.Thisvaluemustmatchthe
valueconfiguredontheUserIDagent.Bydefault,theportis
setto5007onthefirewallandonnewerversionsofthe
UserIDagent.However,someolderUserIDagentversions
useport2010asthedefault.
5. MakesurethattheconfigurationisEnabled,thenclickOK.
6. Committhechanges.
7. VerifythattheConnected statusdisplaysasconnected(a
greenlight).
PaloAltoNetworks,Inc.
UserID MapIPAddressestoUsers

MAPIPADDRESSESTOUSERSUSINGTHEWINDOWSBASEDUSERIDAGENT(Continued)

Step8 VerifythattheUserIDagentis 1. LaunchtheUserIDagentandselectUser Identification.

successfullymappingIPaddressesto
usernamesandthatthefirewallscan
connecttotheagent.
2. VerifythattheagentstatusshowsAgent is running.Ifthe
Agentisnotrunning,clickStart.
3. ToverifythattheUserIDagentcanconnecttomonitored
servers,makesuretheStatusforeachServerisConnected.
4. ToverifythatthefirewallscanconnecttotheUserIDagent,
makesuretheStatusforeachoftheConnectedDevicesis
Connected.
5. ToverifythattheUserIDagentismappingIPaddressesto
usernames,selectMonitoringandmakesurethatthemapping
tableispopulated.YoucanalsoSearchforspecificusers,or
Deleteusermappingsfromthelist.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 433

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

ConfigureUserMappingUsingthePANOSIntegratedUserIDAgent

ThefollowingprocedureshowshowtoconfigurethePANOSintegratedUserIDagentonthefirewallfor
IPaddresstousernamemapping.TheintegratedUserIDagentperformsthesametasksasthe
WindowsbasedagentwiththeexceptionofNetBIOSclientprobing(WMIprobingissupported).

MapIPAddressestoUsersUsingtheIntegratedUserIDAgent

Step1 CreateanActiveDirectoryservice CreateaDedicatedServiceAccountfortheUserIDAgent.

accountfortheUserIDagenttoaccess
theservicesandhostsitwillmonitorfor
collectingusermappinginformation.

Step2 Definetheserversthatthefirewallwill 1. SelectDevice > User Identification > User Mapping.

monitortocollectusermapping
information.
Withinthetotalmaximumof100
monitoredserversperfirewall,youcan
definenomorethan50syslogsenders
foranysinglevirtualsystem.
NOTE:Tocollectalltherequired
mappings,thefirewallmustconnectto
allserversthatyouruserslogintosoit
canmonitortheSecuritylogfilesonall
serversthatcontainloginevents.
2. ClickAddintheServerMonitoringsection.
3. EnteraNametoidentifytheserver.
4. SelecttheTypeofserver.
5. EntertheNetwork Address(anFQDNorIPaddress)ofthe
server.
6. MakesuretheserverprofileisEnabledandclickOK.
7. (Optional)ClickDiscoverifyouwantthefirewallto
automaticallydiscoverdomaincontrollersonyournetwork
usingDNSlookups.
NOTE:Theautodiscoveryfeatureisfordomaincontrollers
only;youmustmanuallyaddanyExchangeserversor
eDirectoryserversyouwanttomonitor.
8. (Optional)Specifythefrequencyatwhichthefirewallpolls
Windowsserversformappinginformation.Thisistheinterval
betweentheendofthelastqueryandthestartofthenext
query.
NOTE:Ifthequeryloadishigh,theobserveddelaybetween
queriesmightsignificantlyexceedthespecifiedfrequency.
a. EditthePaloAltoNetworksUserIDAgentSetup.
b. SelecttheServer MonitortabandspecifytheServer Log
Monitor Frequencyinseconds(defaultis2,rangeis
13600).Increasethevalueinthisfieldto5secondsin
environmentswitholderdomaincontrollersorhighlatency
links.
EnsurethattheEnable Sessionsettingisnot
selected.ThissettingrequiresthattheUserID
agenthaveanActiveDirectoryaccountwithServer
Operatorprivilegessothatitcanreadalluser
sessions.Instead,useaSyslogorXMLAPI
integrationtomonitorsourcesthatcapturelogin
andlogouteventsforalldevicetypesandoperating
systems(insteadofjustWindows),suchaswireless
controllersandNACs.
c. ClickOKtosavethechanges.

434 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
MapIPAddressestoUsersUsingtheIntegratedUserIDAgent(Continued)
Step3 SpecifythesubnetworksthePANOS 1.
integratedUserIDagentshouldinclude 2.
inorexcludefromusermapping.
Bydefault,theUserIDmapsallusers
accessingtheserversyouaremonitoring.
Asabestpractice,alwaysspecify
whichnetworkstoincludeand,
optionally,toexcludefrom
UserIDtoensurethattheagent
isonlycommunicatingwith
internalresourcesandtoprevent
unauthorizedusersfrombeing
mapped.Youshouldonlyenable
usermappingonthe
subnetworkswhereusers
internaltoyourorganizationare
loggingin.
Step4 Setthedomaincredentialsforthe 1.
accountthefirewallwillusetoaccess 2.
Windowsresources.Thisisrequiredfor
monitoringExchangeserversanddomain
controllersaswellasforWMIprobing.
Step5 (Optional,notrecommended)Configure 1.
WMIprobing(thePANOSintegrated
UserIDagentdoesnotsupportNetBIOS 2.
probing).
DonotenableWMIprobingon
highsecuritynetworks.Client
probingcangeneratealarge
amountofnetworktrafficand
canposeasecuritythreatwhen
misconfigured.
Step6 (Optional)Definethesetofusersfor SelecttheIgnore User ListtabandAddeachusernametoexclude
whichyoudontrequireIP
addresstousernamemappings,suchas
kioskaccounts.
Youcanalsousetheignoreuser administratorsinthecorpdomaindomainwhoseusernamesstart
listtoidentifyuserswhomyou
wanttoforcetoauthenticate
usingCaptivePortal.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
SelectDevice > User Identification > User Mapping.
AddanentrytotheInclude/ExcludeNetworksandentera
NamefortheentryandmakesuretokeeptheEnabledcheck
boxselected.
3. EntertheNetwork Addressandthenselectwhetherto
includeorexcludeit:
IncludeSelectthisoptionifyouwanttolimituser
mappingtousersloggedintothespecifiedsubnetwork
only.Forexample,ifyouinclude10.0.0.0/8,theagentmaps
theusersonthatsubnetworkandexcludesallothers.Ifyou
wanttheagenttomapusersinothersubnetworks,you
mustrepeatthesestepstoaddadditionalnetworkstothe
list.
ExcludeSelectthisoptiononlyifyouwanttheagentto
excludeasubsetofthesubnetworksyouaddedfor
inclusion.Forexample,ifyouinclude10.0.0.0/8and
exclude10.2.50.0/22,theagentwillmapusersonallthe
subnetworksof10.0.0.0/8except10.2.50.0/22,andwill
excludeallsubnetworksoutsideof10.0.0.0/8.
Ifyouaddsubnetworksforexclusionwithout
addinganyforinclusion,theagentwillnotperform
usermappinginanysubnetwork.
4. ClickOK.
EditthePaloAltoNetworksUserIDAgentSetup.
SelecttheWMI AuthenticationtabandentertheUser Name
andPasswordfortheaccountthattheUserIDagentwilluse
toprobetheclientsandmonitorservers.Entertheusername
usingthedomain\usernamesyntax.
SelecttheClient ProbingtabandselecttheEnable Probing
checkbox.
(Optional)ModifytheProbe Interval(inminutes)ifnecessary
toensureitislongenoughfortheUserIDagenttoprobeall
thelearnedIPaddresses(defaultis20,rangeis11440).This
istheintervalbetweentheendofthelastproberequestand
thestartofthenextrequest.
NOTE:Iftherequestloadishigh,theobserveddelaybetween
requestsmightsignificantlyexceedthespecifiedinterval.
3. ClickOK.
4. MakesuretheWindowsfirewallwillallowclientprobingby
addingaremoteadministrationexceptiontotheWindows
firewallforeachprobedclient.
fromusermapping.Youcanuseanasteriskasawildcardcharacter
tomatchmultipleusernames,butonlyasthelastcharacterinthe
entry.Forexample,corpdomain\it-admin*wouldmatchall
withthestringit-admin.Youcanaddupto5,000entriesto
excludefromusermapping.
PANOS8.0AdministratorsGuide 435
MapIPAddressestoUsers UserID

MapIPAddressestoUsersUsingtheIntegratedUserIDAgent(Continued)

Step7 Activateyourconfigurationchanges. ClickOKandCommit.

Step8 Verifytheconfiguration. 1. AccessthefirewallCLI.

2. Enterthefollowingoperationalcommand:
> show user server-monitor state all
3. OntheDevice > User Identification > User Mappingtabinthe
webinterface,verifythattheStatusofeachserveryou
configuredforservermonitoringisConnected.

ConfigureUserIDtoMonitorSyslogSendersforUserMapping

ToobtainIPaddresstousernamemappingsfromexistingnetworkservicesthatauthenticateusers,youcan
configurethePANOSintegratedUserIDagentorWindowsbasedUserIDagenttoparseSyslogmessages
fromthoseservices.Tokeepusermappingsuptodate,youcanalsoconfiguretheUserIDagenttoparse
syslogmessagesforlogouteventssothatthefirewallautomaticallydeletesoutdatedmappings.
ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener
ConfiguretheWindowsUserIDAgentasaSyslogListener

ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener

ToconfigurethePANOSIntegratedUserIDagenttocreatenewusermappingsandremoveoutdated
mappingsthroughsyslogmonitoring,startbydefiningSyslogParseprofiles.TheUserIDagentusesthe
profilestofindloginandlogouteventsinsyslogmessages.Inenvironmentswheresyslogsenders(the
networkservicesthatauthenticateusers)deliversyslogmessagesindifferentformats,configureaprofilefor
eachsyslogformat.SyslogmessagesmustmeetcertaincriteriaforaUserIDagenttoparsethem(see
Syslog).Thisprocedureusesexampleswiththefollowingformats:
Loginevents[Tue Jul 5 13:15:04 2016 CDT] Administrator authentication success User:johndoe1
Source:192.168.3.212

Logoutevents[Tue Jul 5 13:18:05 2016 CDT] User logout successful User:johndoe1

Source:192.168.3.212

AfterconfiguringtheSyslogParseprofiles,youspecifysyslogsendersfortheUserIDagenttomonitor.

ThePANOSintegratedUserIDagentacceptssyslogsoverSSLandUDPonly.However,youmustusecaution
whenusingUDPtoreceivesyslogmessagesbecauseitisanunreliableprotocolandassuchthereisnowayto
verifythatamessagewassentfromatrustedsyslogsender.Althoughyoucanrestrictsyslogmessagestospecific
sourceIPaddresses,anattackercanstillspooftheIPaddress,potentiallyallowingtheinjectionofunauthorized
syslogmessagesintothefirewall.Asabestpractice,alwaysuseSSLtolistenforsyslogmessages.However,if
youmustuseUDP,makesurethatthesyslogsenderandclientarebothonadedicated,securenetworkto
preventuntrustedhostsfromsendingUDPtraffictothefirewall.

436 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener
Step1 Determinewhetherthereisa
predefinedSyslogParseprofileforyour
particularsyslogsenders.
PaloAltoNetworksprovidesseveral
predefinedprofilesthroughApplication
contentupdates.Thepredefinedprofiles
areglobaltothefirewall,whereas
customprofilesapplytoasinglevirtual
systemonly.
NOTE:AnynewSyslogParseprofilesin
agivencontentreleaseisdocumentedin
thecorrespondingreleasenotealong
withthespecificregexusedtodefinethe
filter.
Step2 DefinecustomSyslogParseprofilesto
createanddeleteusermappings.
Eachprofilefilterssyslogmessagesto
identifyeitherloginevents(tocreate
usermappings)orlogoutevents(to
deletemappings),butnosingleprofile
candoboth.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
1. InstallthelatestApplicationsorApplicationsandThreats
update:
a. SelectDevice > Dynamic UpdatesandCheck Now.
b. DownloadandInstallanynewupdate.
2. DeterminewhichpredefinedSyslogParseprofilesare
available:
a. SelectDevice > User Identification > User Mappingclick
AddintheServerMonitoringsection.
b. SettheTypetoSyslog SenderandclickAddintheFilter
section.IftheSyslogParseprofileyouneedisavailable,skip
thestepsfordefiningcustomprofiles.
1. Reviewthesyslogmessagesthatthesyslogsendergenerates
toidentifythesyntaxforloginandlogoutevents.Thisenables
youtodefinethematchingpatternswhencreatingSyslog
Parseprofiles.
Whilereviewingsyslogmessages,alsodetermine
whethertheyincludethedomainname.Iftheydont,
andyourusermappingsrequiredomainnames,enter
theDefault Domain Namewhendefiningthesyslog
sendersthattheUserIDagentmonitors(laterinthis
procedure).
2. SelectDevice > User Identification > User Mappingandedit
thePaloAltoNetworksUserIDAgentSetup.
3. SelectSyslog FiltersandAddaSyslogParseprofile.
4. EnteranametoidentifytheSyslog Parse Profile.
5. SelecttheTypeofparsingtofindloginorlogouteventsin
syslogmessages:
Regex IdentifierRegularexpressions.
Field IdentifierTextstrings.
Thefollowingstepsdescribehowtoconfiguretheseparsing
types.
PANOS8.0AdministratorsGuide 437
MapIPAddressestoUsers
ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener(Continued)
Step3 (RegexIdentifierparsingonly)Define 1.
theregexmatchingpatterns.
NOTE:Ifthesyslogmessagecontainsa
standalonespaceortabasadelimiter,
use\sforaspaceand\tforatab.
438 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
EntertheEvent Regexforthetypeofeventsyouwanttofind:
LogineventsFortheexamplemessage,theregex
(authentication\ success){1}extractsthefirst{1}
instanceofthestringauthentication success.
LogouteventsFortheexamplemessage,theregex
(logout\ successful){1}extractsthefirst{1}instance
ofthestringlogout successful.
Thebackslash(\)beforethespaceisastandardregexescape
characterthatinstructstheregexenginenottotreatthespace
asaspecialcharacter.
2. EntertheUsername Regextoidentifythestartofthe
username.
Intheexamplemessage,theregex
User:([a-zA-Z0-9\\\._]+)matchesthestring
User:johndoe1andidentifiesjohndoe1astheusername.
3. EntertheAddress RegextoidentifytheIPaddressportionof
syslogmessages.
Intheexamplemessage,theregularexpression
Source:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{
1,3})matchestheIPv4addressSource:192.168.3.212.
ThefollowingisanexampleofacompletedSyslogParse
profilethatusesregextoidentifyloginevents:
4. ClickOKtwicetosavetheprofile.
PaloAltoNetworks,Inc.
UserID MapIPAddressestoUsers

ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener(Continued)

Step4 (FieldIdentifierparsingonly)Define 1. EnteranEvent Stringtoidentifythetypeofeventsyouwant

stringmatchingpatterns. tofind.
LogineventsFortheexamplemessage,thestring
authentication successidentifiesloginevents.
LogouteventsFortheexamplemessage,thestring
logout successfulidentifieslogoutevents.
2. EnteraUsername Prefixtoidentifythestartoftheusername
fieldinsyslogmessages.Thefielddoesnotsupportregex
expressionssuchas\s(foraspace)or\t(foratab).
Intheexamplemessages,User:identifiesthestartofthe
usernamefield.
3. EntertheUsername Delimiterthatindicatestheendofthe
usernamefieldinsyslogmessages.Use\stoindicatea
standalonespace(asinthesamplemessage)and\ttoindicate
atab.
4. EnteranAddress PrefixtoidentifythestartoftheIPaddress
fieldinsyslogmessages.Thefielddoesnotsupportregex
expressionssuchas\s(foraspace)or\t(foratab).
Intheexamplemessages,Source:identifiesthestartofthe
addressfield.
5. EntertheAddress DelimiterthatindicatestheendoftheIP
addressfieldinsyslogmessages.
Forexample,enter\ntoindicatethedelimiterisalinebreak.
ThefollowingisanexampleofacompletedSyslogParse
profilethatusesstringmatchingtoidentifyloginevents:

6. ClickOKtwicetosavetheprofile.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 439

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers
ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener(Continued)
Step5 Specifythesyslogsendersthatthe
firewallmonitors.
Withinthetotalmaximumof100
monitoredserversperfirewall,youcan
definenomorethan50syslogsenders
foranysinglevirtualsystem.
Thefirewalldiscardsanysyslog
messagesreceivedfromsendersthatare
notonthislist.
440 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
1. SelectDevice > User Identification > User MappingandAdd
anentrytotheServerMonitoringlist.
2. EnteraNametoidentifythesender.
3. MakesurethesenderprofileisEnabled(defaultisenabled).
4. SettheTypetoSyslog Sender.
5. EntertheNetwork Addressofthesyslogsender(IPaddressor
FQDN).
6. SelectSSL(default)orUDPastheConnection Type.
UsecautionwhenusingUDPtoreceivesyslog
messagesbecauseitisanunreliableprotocolandas
suchthereisnowaytoverifythatamessagewassent
fromatrustedsyslogsender.Althoughyoucanrestrict
syslogmessagestospecificsourceIPaddresses,an
attackercanstillspooftheIPaddress,potentially
allowingtheinjectionofunauthorizedsyslogmessages
intothefirewall.Asabestpractice,alwaysuseSSLto
listenforsyslogmessageswhenusingagentlessUser
Mappingonafirewall.However,ifyoumustuseUDP,
makesurethatthesyslogsenderandclientarebothon
adedicated,securenetworktopreventuntrusted
hostsfromsendingUDPtraffictothefirewall.
AsyslogsenderusingSSLtoconnectwillshowa
StatusofConnectedonlywhenthereisanactiveSSL
connection.SyslogsendersusingUDPwillnotshowa
Statusvalue.
7. Foreachsyslogformatthatthesendersupports,AddaSyslog
ParseprofiletotheFilterlist.SelecttheEvent Typethateach
profileisconfiguredtoidentify:login(default)orlogout.
8. (Optional)Ifthesyslogmessagesdontcontaindomain
informationandyourusermappingsrequiredomainnames,
enteraDefault Domain Nametoappendtothemappings.
9. ClickOKtosavethesettings.
PaloAltoNetworks,Inc.
UserID MapIPAddressestoUsers

ConfigurethePANOSIntegratedUserIDAgentasaSyslogListener(Continued)

Step6 Enablesysloglistenerservicesonthe 1. SelectNetwork > Network Profiles > Interface Mgmtandedit

interfacethatthefirewallusestocollect
usermappings.
anexistingInterfaceManagementprofileorAddanewprofile.
2. SelectUser-ID Syslog Listener-SSLorUser-ID Syslog
Listener-UDPorboth,basedontheprotocolsyoudefinedfor
thesyslogsendersintheServerMonitoringlist.
NOTE:Thelisteningports(514forUDPand6514forSSL)are
notconfigurable;theyareenabledthroughthemanagement
serviceonly.
3. ClickOKtosavetheinterfacemanagementprofile.
NOTE:EvenafterenablingtheUserIDSyslogListenerservice
ontheinterface,theinterfaceonlyacceptssyslogconnections
fromsendersthathaveacorrespondingentryintheUserID
monitoredserversconfiguration.Thefirewalldiscards
connectionsormessagesfromsendersthatarenotonthelist.
4. AssigntheInterfaceManagementprofiletotheinterfacethat
thefirewallusestocollectusermappings:
a. SelectNetwork > Interfacesandedittheinterface.
b. SelectAdvanced > Other info,selecttheInterface
Management Profileyoujustadded,andclickOK.
5. Commityourchanges.

Step7 Verifythatthefirewalladdsanddeletes 1. Logintoaclientsystemforwhichamonitoredsyslogsender

usermappingswhenusersloginandout. generatesloginandlogouteventmessages.
YoucanuseCLIcommandsto 2. LogintothefirewallCLI.
seeadditionalinformationabout
3. Verifythatthefirewallmappedtheloginusernametothe
syslogsenders,syslogmessages,
clientIPaddress:
andusermappings.
> show user ip-user-mapping ip <ip-address>
IP address: 192.0.2.1 (vsys1)
User: localdomain\username
From: SYSLOG
4. Logoutoftheclientsystem.
5. Verifythatthefirewalldeletedtheusermapping:
> show user ip-user-mapping ip <ip-address>
No matched record

ConfiguretheWindowsUserIDAgentasaSyslogListener

ToconfiguretheWindowsbasedUserIDagenttocreatenewusermappingsandremoveoutdated
mappingsthroughsyslogmonitoring,startbydefiningSyslogParseprofiles.TheUserIDagentusesthe
profilestofindloginandlogouteventsinsyslogmessages.Inenvironmentswheresyslogsenders(the
networkservicesthatauthenticateusers)deliversyslogmessagesindifferentformats,configureaprofilefor
eachsyslogformat.SyslogmessagesmustmeetcertaincriteriaforaUserIDagenttoparsethem(see
Syslog).Thisprocedureusesexampleswiththefollowingformats:
Loginevents[Tue Jul 5 13:15:04 2016 CDT] Administrator authentication success User:johndoe1
Source:192.168.3.212

Logoutevents[Tue Jul 5 13:18:05 2016 CDT] User logout successful User:johndoe1

Source:192.168.3.212

AfterconfiguringtheSyslogParseprofiles,youspecifythesyslogsendersthattheUserIDagentmonitors.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 441

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

TheWindowsUserIDagentacceptssyslogsoverTCPandUDPonly.However,youmustuse
cautionwhenusingUDPtoreceivesyslogmessagesbecauseitisanunreliableprotocolandas
suchthereisnowaytoverifythatamessagewassentfromatrustedsyslogsender.Althoughyou
canrestrictsyslogmessagestospecificsourceIPaddresses,anattackercanstillspooftheIP
address,potentiallyallowingtheinjectionofunauthorizedsyslogmessagesintothefirewall.Asa
bestpractice,useTCPinsteadofUDP.Ineithercase,makesurethatthesyslogsenderandclient
arebothonadedicated,secureVLANtopreventuntrustedhostsfromsendingsyslogstothe
UserIDagent.

ConfiguretheWindowsBasedUserIDAgenttoCollectUserMappingsfromSyslogSenders

Step1 DeploytheWindowsbasedUserID 1. InstalltheWindowsBasedUserIDAgent.

agentsifyouhaventalready. 2. ConfigurethefirewalltoconnecttotheUserIDagent.

Step2 DefinecustomSyslogParseprofilesto 1. Reviewthesyslogmessagesthatthesyslogsendergenerates

createanddeleteusermappings.
Eachprofilefilterssyslogmessagesto
identifyeitherloginevents(tocreate
usermappings)orlogoutevents(to
deletemappings),butnosingleprofile
candoboth.
toidentifythesyntaxforloginandlogoutevents.Thisenables
youtodefinethematchingpatternswhencreatingSyslog
Parseprofiles.
Whilereviewingsyslogmessages,alsodetermine
whethertheyincludethedomainname.Iftheydont,
andyourusermappingsrequiredomainnames,enter
theDefault Domain Namewhendefiningthesyslog
sendersthattheUserIDagentmonitors(laterinthis
procedure).
2. OpentheWindowsStartmenuandselectUser-ID Agent.
3. SelectUser Identification > SetupandEdittheSetup.
4. SelectSyslog,Enable Syslog Service,andAddaSyslogParse
profile.
5. EnteraProfile NameandDescription.
6. SelecttheTypeofparsingtofindloginandlogouteventsin
syslogmessages:
RegexRegularexpressions.
FieldTextstrings.
Thefollowingstepsdescribehowtoconfiguretheseparsing
types.

442 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
ConfiguretheWindowsBasedUserIDAgenttoCollectUserMappingsfromSyslogSenders(Continued)
Step3 (Regexparsingonly)Definetheregex
matchingpatterns.
Ifthesyslogmessagecontainsa
standalonespaceortabasadelimiter,
use\sforaspaceand\tforatab.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
1. EntertheEvent Regexforthetypeofeventsyouwanttofind:
LogineventsFortheexamplemessage,theregex
(authentication\ success){1}extractsthefirst{1}
instanceofthestringauthentication success.
LogouteventsFortheexamplemessage,theregex
(logout\ successful){1}extractsthefirst{1}instance
ofthestringlogout successful.
Thebackslashbeforethespaceisastandardregexescape
characterthatinstructstheregexenginenottotreatthespace
asaspecialcharacter.
2. EntertheUsername Regextoidentifythestartofthe
username.
Intheexamplemessage,theregex
User:([a-zA-Z0-9\\\._]+)matchesthestring
User:johndoe1andidentifiesjohndoe1astheusername.
3. EntertheAddress RegextoidentifytheIPaddressportionof
syslogmessages.
Intheexamplemessage,theregularexpression
Source:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{
1,3})matchestheIPv4addressSource:192.168.3.212.
ThefollowingisanexampleofacompletedSyslogParse
profilethatusesregextoidentifyloginevents:
4. ClickOKtwicetosavetheprofile.
PANOS8.0AdministratorsGuide 443
MapIPAddressestoUsers UserID

ConfiguretheWindowsBasedUserIDAgenttoCollectUserMappingsfromSyslogSenders(Continued)

Step4 (FieldIdentifierparsingonly)Define 1. EnteranEvent Stringtoidentifythetypeofeventsyouwant

stringmatchingpatterns. tofind.
LogineventsFortheexamplemessage,thestring
authentication successidentifiesloginevents.
LogouteventsFortheexamplemessage,thestring
logout successfulidentifieslogoutevents.
2. EnteraUsername Prefixtoidentifythestartoftheusername
fieldinsyslogmessages.Thefielddoesnotsupportregex
expressionssuchas\s(foraspace)or\t(foratab).
Intheexamplemessages,User:identifiesthestartofthe
usernamefield.
3. EntertheUsername Delimiterthatindicatestheendofthe
usernamefieldinsyslogmessages.Use\stoindicatea
standalonespace(asinthesamplemessage)and\ttoindicate
atab.
4. EnteranAddress PrefixtoidentifythestartoftheIPaddress
fieldinsyslogmessages.Thefielddoesnotsupportregex
expressionssuchas\s(foraspace)or\t(foratab).
Intheexamplemessages,Source:identifiesthestartofthe
addressfield.
5. EntertheAddress DelimiterthatindicatestheendoftheIP
addressfieldinsyslogmessages.
Forexample,enter\ntoindicatethedelimiterisalinebreak.
ThefollowingisanexampleofacompletedSyslogParse
profilethatusesstringmatchingtoidentifyloginevents:

6. ClickOKtwicetosavetheprofile.

444 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
ConfiguretheWindowsBasedUserIDAgenttoCollectUserMappingsfromSyslogSenders(Continued)
Step5 Specifythesyslogsendersthatthe
UserIDagentmonitors.
Withinthetotalmaximumof100servers
ofalltypesthattheUserIDagentcan
monitor,upto50canbesyslogsenders.
TheUserIDagentdiscardsanysyslog
messagesreceivedfromsendersthatare
notonthislist.
Step6 VerifythattheUserIDagentaddsand 1.
deletesusermappingswhenuserslogin
andout.
YoucanuseCLIcommandsto
seeadditionalinformationabout
syslogsenders,syslogmessages,
andusermappings.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
1. SelectUser Identification > DiscoveryandAddanentrytothe
Serverslist.
2. EnteraNametoidentifythesender.
3. EntertheServer Addressofthesyslogsender(IPaddressor
FQDN).
4. SettheServer TypetoSyslog Sender.
5. (Optional)Ifthesyslogmessagesdontcontaindomain
informationandyourusermappingsrequiredomainnames,
enteraDefault Domain Nametoappendtothemappings.
6. Foreachsyslogformatthatthesendersupports,AddaSyslog
ParseprofiletotheFilterlist.SelecttheEvent Typethatyou
configuredeachprofiletoidentifylogin(default)orlogout
andthenclickOK.
7. ClickOKtosavethesettings.
8. CommityourchangestotheUserIDagentconfiguration.
Logintoaclientsystemforwhichamonitoredsyslogsender
generatesloginandlogouteventmessages.
2. VerifythattheUserIDagentmappedtheloginusernameto
theclientIPaddress:
a. IntheUserIDagent,selectMonitoring.
b. EntertheusernameorIPaddressinthefilterfield,Search,
andverifythatthelistdisplaysthemapping.
3. Verifythatthefirewallreceivedtheusermappingfromthe
UserIDagent:
a. LogintothefirewallCLI.
b. Runthefollowingcommand:
> show user ip-user-mapping ip <ip-address>
Ifthefirewallreceivedtheusermapping,theoutput
resemblesthefollowing:
IP address: 192.0.2.1 (vsys1)
User: localdomain\username
From: SYSLOG
4. Logoutoftheclientsystem.
5. VerifythattheUserIDagentremovedtheusermapping:
a. IntheUserIDagent,selectMonitoring.
b. EntertheusernameorIPaddressinthefilterfield,Search,
andverifythatthelistdoesnotdisplaythemapping.
6. Verifythatthefirewalldeletedtheusermapping:
a. AccessthefirewallCLI.
b. Runthefollowingcommand:
> show user ip-user-mapping ip <ip-address>
Ifthefirewalldeletedtheusermapping,theoutput
displays:
No matched record
PANOS8.0AdministratorsGuide 445
MapIPAddressestoUsers UserID

MapIPAddressestoUsernamesUsingCaptivePortal

Whenauserinitiateswebtraffic(HTTPorHTTPS)thatmatchesanAuthenticationPolicyrule,thefirewall
promptstheusertoauthenticatethroughCaptivePortal.Thisensuresthatyouknowexactlywhois
accessingyourmostsensitiveapplicationsanddata.Basedonuserinformationcollectedduring
authentication,thefirewallcreatesanewIPaddresstousernamemappingorupdatestheexistingmapping
forthatuser.Thismethodofusermappingisusefulinenvironmentswherethefirewallcannotlearn
mappingsthroughothermethodssuchasmonitoringservers.Forexample,youmighthaveuserswhoare
notloggedintoyourmonitoreddomainservers,suchasusersonLinuxclients.
CaptivePortalAuthenticationMethods
CaptivePortalModes
ConfigureCaptivePortal

CaptivePortalAuthenticationMethods

CaptivePortalusesthefollowingmethodstoauthenticateuserswhosewebrequestsmatchAuthentication
Policyrules:

AuthenticationMethod Description

KerberosSSO ThefirewallusesKerberossinglesignon(SSO)totransparentlyobtainuser
credentialsfromthebrowser.Tousethismethod,yournetworkrequiresa
Kerberosinfrastructure,includingakeydistributioncenter(KDC)withan
authenticationserverandticketgrantingservice.Thefirewallmusthavea
Kerberosaccount.
IfKerberosSSOauthenticationfails,thefirewallfallsbacktoNTLANManager
(NTLM)authentication.IfyoudontconfigureNTLM,orNTLMauthentication
fails,thefirewallfallsbacktowebformorclientcertificateauthentication,
dependingonyourAuthenticationpolicyandCaptivePortalconfiguration.
KerberosSSOispreferabletoNTLMauthentication.Kerberosisa
stronger,morerobustauthenticationmethodthanNTLManditdoesnot
requirethefirewalltohaveanadministrativeaccounttojointhedomain.

NTLANManager(NTLM)
Thefirewallusesanencryptedchallengeresponsemechanismtoobtaintheuser
credentialsfromthebrowser.Whenconfiguredproperly,thebrowserwill
transparentlyprovidethecredentialstothefirewallwithoutpromptingtheuser,
butwillpromptforcredentialsifnecessary.
IfyouusetheWindowsbasedUserIDagent,NTLMresponsesgodirectlytothe
domaincontrollerwhereyouinstalledtheagent.
IfyouconfigureKerberosSSOauthentication,thefirewalltriesthatmethodfirst
beforefallingbacktoNTLMauthentication.IfthebrowsercantperformNTLM
orifNTLMauthenticationfails,thefirewallfallsbacktowebformorclient
certificateauthentication,dependingonyourAuthenticationpolicyandCaptive
Portalconfiguration.
MicrosoftInternetExplorersupportsNTLMbydefault.YoucanconfigureMozilla
FirefoxandGoogleChrometoalsouseNTLMbutyoucantuseNTLMto
authenticatenonWindowsclients.

446 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID MapIPAddressestoUsers

AuthenticationMethod Description

WebForm Thefirewallredirectswebrequeststoawebformforauthentication.Forthis
method,youcanconfigureAuthenticationpolicytouseMultiFactor
Authentication(MFA),SAML,Kerberos,TACACS+,RADIUS,orLDAP
authentication.Althoughusershavetomanuallyentertheirlogincredentials,this
methodworkswithallbrowsersandoperatingsystems.

ClientCertificateAuthentication Thefirewallpromptsthebrowsertopresentavalidclientcertificateto
authenticatetheuser.Tousethismethod,youmustprovisionclientcertificates
oneachusersystemandinstallthetrustedcertificateauthority(CA)certificate
usedtoissuethosecertificatesonthefirewall.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 447

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

CaptivePortalModes

TheCaptivePortalmodedefineshowthefirewallcaptureswebrequestsforauthentication:

Mode Description

Transparent ThefirewallinterceptsthebrowsertrafficpertheAuthenticationpolicyruleand
impersonatestheoriginaldestinationURL,issuinganHTTP401toinvoke
authentication.However,becausethefirewalldoesnothavetherealcertificate
forthedestinationURL,thebrowserdisplaysacertificateerrortousers
attemptingtoaccessasecuresite.Therefore,usethismodeonlywhenabsolutely
necessary,suchasinLayer 2orvirtualwiredeployments.

Redirect ThefirewallinterceptsunknownHTTPorHTTPSsessionsandredirectsthemto
aLayer 3interfaceonthefirewallusinganHTTP302redirecttoperform
authentication.Thisisthepreferredmodebecauseitprovidesabetterenduser
experience(nocertificateerrors).However,itdoesrequireadditionalLayer3
configuration.AnotherbenefitoftheRedirectmodeisthatitprovidesfortheuse
ofsessioncookies,whichenabletheusertocontinuebrowsingtoauthenticated
siteswithoutrequiringremappingeachtimethetimeoutsexpire.Thisis
especiallyusefulforuserswhoroamfromoneIPaddresstoanother(forexample,
fromthecorporateLANtothewirelessnetwork)becausetheywontneedto
reauthenticatewhentheIPaddresschangesaslongasthesessionstaysopen.
IfyouuseKerberosSSOorNTLMauthentication,youmustuseRedirectmode
becausethebrowserwillprovidecredentialsonlytotrustedsites.Redirectmode
isalsorequiredifyouuseMultiFactorAuthenticationtoauthenticateCaptive
Portalusers.

448 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID MapIPAddressestoUsers

ConfigureCaptivePortal

ThefollowingprocedureshowshowtosetupCaptivePortalauthenticationbyconfiguringthePANOS
integratedUserIDagenttoredirectwebrequeststhatmatchanAuthenticationPolicyruletoafirewall
interface(redirecthost).Basedontheirsensitivity,theapplicationsthatusersaccessthroughCaptivePortal
requiredifferentauthenticationmethodsandsettings.Toaccommodateallauthenticationrequirements,
youcanusedefaultandcustomauthenticationenforcementobjects.Eachobjectassociatesan
AuthenticationrulewithanauthenticationprofileandaCaptivePortalauthenticationmethod.
DefaultauthenticationenforcementobjectsUsethedefaultobjectsifyouwanttoassociatemultiple
Authenticationruleswiththesameglobalauthenticationprofile.Youmustconfigurethisauthentication
profilebeforeconfiguringCaptivePortal,andthenassignitintheCaptivePortalSettings.For
AuthenticationrulesthatrequireMultiFactorAuthentication(MFA),youcannotusedefault
authenticationenforcementobjects.
CustomauthenticationenforcementobjectsUseacustomobjectforeachAuthenticationrulethat
requiresanauthenticationprofilethatdiffersfromtheglobalprofile.Customobjectsaremandatoryfor
AuthenticationrulesthatrequireMFA.Tousecustomobjects,createauthenticationprofilesandassign
themtotheobjectsafterconfiguringCaptivePortalwhenyouConfigureAuthenticationPolicy.
KeepinmindthatauthenticationprofilesarenecessaryonlyifusersauthenticatethroughaCaptivePortal
WebForm,KerberosSSO,orNTLANManager(NTLM).Alternatively,orinadditiontothesemethods,the
followingprocedurealsodescribeshowtoimplementClientCertificateAuthentication.

IfyouuseCaptivePortalwithouttheotherUserIDfunctions(usermappingandgroupmapping),
youdontneedtoconfigureaUserIDagent.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 449

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

ConfigureCaptivePortalUsingthePANOSIntegratedUserIDAgent

Step1 Configuretheinterfacesthatthefirewall 1. (MGTinterfaceonly)SelectDevice > Setup > Interfaces,edit

willuseforincomingwebrequests,
authenticatingusers,and
communicatingwithdirectoryserversto
mapusernamestoIPaddresses.
Thefirewallusesthemanagement(MGT)
interfaceforallthesefunctionsby
default,butyoucanconfigureother
interfaces.Inredirectmode,youmust
useaLayer3interfaceforredirecting
requests.
theManagementinterface,selectUser-ID,andclickOK.
2. (NonMGTinterfaceonly)AssignanInterfaceManagement
profiletotheLayer3interfacethatthefirewallwillusefor
incomingwebrequestsandcommunicationwithdirectory
servers.YoumustenableResponse PagesandUser-IDinthe
InterfaceManagementprofile.
3. (NonMGTinterfaceonly)Configureaservicerouteforthe
interfacethatthefirewallwillusetoauthenticateusers.Ifthe
firewallhasmorethanonevirtualsystem(vsys),theservice
routecanbeglobalorvsysspecific.Theservicesmustinclude
LDAPandpotentiallythefollowing:
Kerberos,RADIUS,TACACS+,orMulti-Factor
AuthenticationConfigureaservicerouteforany
authenticationservicesthatyouuse.
UID AgentConfigurethisserviceonlyifyouwillenableNT
LANManager(NTLM)authenticationorifyouwillEnable
UserandGroupBasedPolicy.
4. (Redirectmodeonly)CreateaDNSaddress(A)recordthat
mapstheIPaddressontheLayer3interfacetotheredirect
host.IfyouwilluseKerberosSSO,youmustalsoaddaDNS
pointer(PTR)recordthatperformsthesamemapping.
Ifyournetworkdoesntsupportaccesstothedirectoryservers
fromanyfirewallinterface,youmustConfigureUserMapping
UsingtheWindowsUserIDAgent.

Step2 MakesureDomainNameSystem(DNS) Toverifyproperresolution,pingtheserverFQDN.Forexample:

isconfiguredtoresolveyourdomain admin@PA-200> ping host dc1.acme.com
controlleraddresses.

450 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
ConfigureCaptivePortalUsingthePANOSIntegratedUserIDAgent(Continued)
Step3 ConfigureclientstotrustCaptivePortal
certificates.
Requiredforredirectmodeto
transparentlyredirectuserswithout
displayingcertificateerrors.Youcan
generateaselfsignedcertificateor
importacertificatethatanexternal
certificateauthority(CA)signed.
Step4 (Optional)ConfigureClientCertificate 1.
Authentication.
NOTE:Youdontneedanauthentication
profileorsequenceforclientcertificate 2.
authentication.Ifyouconfigurebothan
authenticationprofile/sequenceand
certificateauthentication,usersmust
authenticateusingboth.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
Touseaselfsignedcertificate,createarootCAcertificateanduse
ittosignthecertificateyouwilluseforCaptivePortal:
1. SelectDevice > Certificate Management > Certificates >
Device Certificates.
2. CreateaSelfSignedRootCACertificateorimportaCA
certificate(seeImportaCertificateandPrivateKey).
3. GenerateaCertificatetouseforCaptivePortal.Besureto
configurethefollowingfields:
Common NameEntertheDNSnameoftheintranethost
fortheLayer 3interface.
Signed BySelecttheCAcertificateyoujustcreatedor
imported.
CertificateAttributesClickAdd,fortheTypeselectIPand,
fortheValue,entertheIPaddressoftheLayer 3interface
towhichthefirewallwillredirectrequests.
4. ConfigureanSSL/TLSServiceProfile.AssigntheCaptive
Portalcertificateyoujustcreatedtotheprofile.
5. Configureclientstotrustthecertificate:
a. ExporttheCAcertificateyoucreatedorimported.
b. ImportthecertificateasatrustedrootCAintoallclient
browsers,eitherbymanuallyconfiguringthebrowserorby
addingthecertificatetothetrustedrootsinanActive
Directory(AD)GroupPolicyObject(GPO).
UsearootCAcertificatetogenerateaclientcertificatefor
eachuserwhowillauthenticatethroughCaptivePortal.The
CAinthiscaseisusuallyyourenterpriseCA,notthefirewall.
ExporttheCAcertificateinPEMformattoasystemthatthe
firewallcanaccess.
3. ImporttheCAcertificateontothefirewall:seeImporta
CertificateandPrivateKey.Aftertheimport,clickthe
importedcertificate,selectTrusted Root CA,andclickOK.
4. ConfigureaCertificateProfile.
IntheUsername Fielddropdown,selectthecertificate
fieldthatcontainstheuseridentityinformation.
IntheCA Certificateslist,clickAddandselecttheCA
certificateyoujustimported.
PANOS8.0AdministratorsGuide 451
MapIPAddressestoUsers
ConfigureCaptivePortalUsingthePANOSIntegratedUserIDAgent(Continued)
Step5 (Optional)EnableNTLANManager
(NTLM)authentication.
Asabestpractice,choose
Kerberossinglesignon(SSO)or
SAMLSSOauthenticationover
NTLMauthentication.Kerberos
andSAMLarestronger,more
robustauthenticationmethods
thanNTLManddonotrequire
thefirewalltohavean
administrativeaccounttojointhe
domain.Ifyoudoconfigure
NTLM,thePANOSintegrated
UserIDagentmustbeableto
successfullyresolvetheDNS
nameofyourdomaincontroller
tojointhedomain.
452 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
1. Ifyouhaventalreadydoneso,CreateaDedicatedService
AccountfortheUserIDAgent.
Asabestpractice,youuseaUserIDagentaccount
thatisseparatefromyourfirewalladministrator
account.
2. SelectDevice > User Identification > User Mappingandedit
thePaloAltoNetworksUserIDAgentSetupsection.
3. SelectNTLMandEnable NTLM authentication processing.
4. EntertheNTLM DomainagainstwhichtheUserIDagenton
thefirewallwillcheckNTLMcredentials.
5. EntertheAdmin User NameandPasswordoftheActive
DirectoryaccountyoucreatedfortheUserIDagent.
DonotincludethedomainintheAdmin User Name
field.Otherwise,thefirewallwillfailtojointhe
domain.
6. ClickOKtosaveyoursettings.
PaloAltoNetworks,Inc.
UserID MapIPAddressestoUsers

ConfigureCaptivePortalUsingthePANOSIntegratedUserIDAgent(Continued)

Step6 ConfiguretheCaptivePortalsettings. 1. SelectDevice > User Identification > Captive Portal Settings
andeditthesettings.
2. Enable Captive Portal(defaultisenabled).
3. SpecifytheTimer,whichisthemaximumtimeinminutesthat
thefirewallretainsanIPaddresstousernamemappingfora
userafterthatuserauthenticatesthroughCaptivePortal
(defaultis60;rangeis1to1,440).AftertheTimerexpires,the
firewallremovesthemappingandanyassociated
AuthenticationTimestampsusedtoevaluatetheTimeoutin
Authenticationpolicyrules.
WhenevaluatingtheCaptivePortalTimerandthe
TimeoutvalueineachAuthenticationpolicyrule,the
firewallpromptstheusertoreauthenticatefor
whicheversettingexpiresfirst.Upon
reauthenticating,thefirewallresetsthetimecount
fortheCaptivePortalTimerandrecordsnew
authenticationtimestampsfortheuser.Therefore,to
enabledifferentTimeoutperiodsfordifferent
Authenticationrules,settheCaptivePortalTimertoa
valuethesameasorhigherthananyruleTimeout.
4. SelecttheSSL/TLS Service Profileyoucreatedforredirect
requestsoverTLS.SeeConfigureanSSL/TLSServiceProfile.
5. SelecttheMode(inthisexample,Redirect).
6. (Redirectmodeonly)SpecifytheRedirect Host,whichisthe
intranethostname(ahostnamewithnoperiodinitsname)
thatresolvestotheIPaddressoftheLayer3interfaceonthe
firewalltowhichwebrequestsareredirected.
IfusersauthenticatethroughKerberossinglesignon
(SSO),theRedirect Hostmustbethesameasthe
hostnamespecifiedintheKerberoskeytab.
7. SelecttheauthenticationmethodtouseifNTLMfails(orif
youdontuseNTLM):
Touseclientcertificateauthentication,selectthe
Certificate Profileyoucreated.
TouseglobalsettingsforinteractiveorSSOauthentication,
selecttheAuthentication Profileyouconfigured.
TouseAuthenticationpolicyrulespecificsettingsfor
interactiveorSSOauthentication,assignauthentication
profilestoauthenticationenforcementobjectswhenyou
ConfigureAuthenticationPolicy.
8. ClickOKandCommittheCaptivePortalconfiguration.

Step7 Nextsteps... ThefirewalldoesnotdisplaytheCaptivePortalwebformtousers

untilyouConfigureAuthenticationPolicyrulesthattrigger
authenticationwhenusersrequestservicesorapplications.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 453

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

ConfigureUserMappingforTerminalServerUsers

IndividualterminalserverusersappeartohavethesameIPaddressandthereforeanIP
addresstousernamemappingisnotsufficienttoidentifyaspecificuser.Toenableidentificationofspecific
usersonWindowsbasedterminalservers,thePaloAltoNetworksTerminalServicesagent(TSagent)
allocatesaportrangetoeachuser.Itthennotifieseveryconnectedfirewallabouttheallocatedportrange,
whichallowsthefirewalltocreateanIPaddressportusermappingtableandenableuserandgroupbased
securitypolicyenforcement.FornonWindowsterminalservers,youcanconfigurethePANOSXMLAPIto
extractusermappinginformation.
Thefollowingsectionsdescribehowtoconfigureusermappingforterminalserverusers:
ConfigurethePaloAltoNetworksTerminalServicesAgentforUserMapping
RetrieveUserMappingsfromaTerminalServerUsingthePANOSXMLAPI

ConfigurethePaloAltoNetworksTerminalServicesAgentforUserMapping

UsethefollowingproceduretoinstallandconfiguretheTSagentontheterminalserver.Tomapallyour
users,youmustinstalltheTSagentonallterminalserversthatyourusersloginto.

ForinformationaboutthesupportedterminalserverssupportedbytheTSAgent,refertothe
PaloAltoNetworksCompatibilityMatrix.

ConfigurethePaloAltoNetworksTerminalServicesAgentforUserMapping

Step1 DownloadtheTSagentinstaller. 1. LogintothePaloAltoNetworksCustomerSupportwebsite.

2. SelectSoftware UpdatesfromtheManageDevicessection.
3. ScrolltotheTerminal Services AgentsectionandDownload
theversionoftheagentyouwanttoinstall.
4. SavetheTaInstall64.x64-x.x.x-xx.msior
TaInstall-x.x.x-xx.msi file(besuretoselectthe
appropriateversionbasedonwhethertheWindowssystemis
runninga32bitOSora64bitOS)onthesystemswhereyou
plantoinstalltheagent.

454 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID
ConfigurethePaloAltoNetworksTerminalServicesAgentforUserMapping(Continued)
Step2 Runtheinstallerasanadministrator.
Step3 Definetherangeofportsforthe
TS Agenttoallocatetoendusers.
NOTE:TheSystem Source Port
Allocation RangeandSystem Reserved
Source Portsfieldsspecifytherangeof
portsthatwillbeallocatedtononuser
sessions.Makesurethevaluesspecified
inthesefieldsdonotoverlapwiththe
portsyoudesignateforusertraffic.
Thesevaluescanonlybechangedby
editingthecorrespondingWindows
registrysettings.
PaloAltoNetworks,Inc.
Copyright 2007-2017 Palo Alto Networks
MapIPAddressestoUsers
1. OpentheWindowsStartmenu,rightclicktheCommand
Promptprogram,andselectRun as administrator.
2. Fromthecommandline,runthe.msifileyoudownloaded.For
example,ifyousavedthe.msifiletotheDesktopyouwould
enterthefollowing:
C:\Users\administrator.acme>cd Desktop
C:\Users\administrator.acme\Desktop>TaInstall-8.0.
0-1.msi
3. Followthesetuppromptstoinstalltheagentusingthedefault
settings.Bydefault,theagentgetsinstalledtothe
C:\Program Files (x86)\Palo Alto Networks\Terminal
Server Agentfolder,butyoucanBrowsetoadifferent
location.
4. Whentheinstallationcompletes,Closethesetupwindow.
NOTE:IfyouareupgradingtoaTSAgentversionthathasa
newerdriverthantheexistinginstallation,theinstallation
wizardpromptsyoutorebootthesystemafterupgradingin
ordertousethenewdriver.
1. OpentheWindowsStartmenuandselectTerminal Server
AgenttolaunchtheTerminalServicesagentapplication.
2. SelectConfigureinthesidemenu.
3. EntertheSource Port Allocation Range(default
2000039999).Thisisthefullrangeofportnumbersthatthe
TSagentwillallocateforusermapping.Theportrangeyou
specifycannotoverlapwiththeSystem Source Port
Allocation Range.
4. (Optional)Ifthereareports/portrangeswithinthesource
portallocationthatyoudonotwanttheTSAgenttoallocate
tousersessions,specifythemasReserved Source Ports.To
includemultipleranges,usecommaswithnospaces,for
example:2000-3000,3500,4000-5000.
5. Specifythenumberofportstoallocatetoeachindividualuser
uponlogintotheterminalserverinthePort Allocation Start
Size Per User field(default200).
6. SpecifythePort Allocation Maximum Size Per User,whichis
themaximumnumberofportstheTerminalServicesagent
canallocatetoanindividualuser.
7. Specifywhethertocontinueprocessingtrafficfromtheuserif
theuserrunsoutofallocatedports.Bydefault,theFail port
binding when available ports are used upisselected,which
indicatesthattheapplicationwillfailtosendtrafficwhenall
portsareused.Toenableuserstocontinueusingapplications
whentheyrunoutofports,clearthischeckbox.Keepinmind
thatthistrafficmaynotbeidentifiedwithUserID.
PANOS8.0AdministratorsGuide 455
MapIPAddressestoUsers
ConfigurethePaloAltoNetworksTerminalServicesAgentforUserMapping(Continued)
Step4 (Optional)Assignyourowncertificates 1.
formutualauthenticationbetweenthe
TSagentandthefirewall.
Step5 Configurethefirewalltoconnecttothe Completethefollowingstepsoneachfirewallyouwanttoconnect
TerminalServicesagent.
456 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
ObtainyourcertificatefortheTSagentforyourenterprise
PKIorgenerateoneonyourfirewall.Theprivatekeyofthe
servercertificatemustbeencrypted.Thecertificatemustbe
uploadedinPEMfileformat.
GenerateaCertificateandexportitforuploadtotheTS
agent.
Exportacertificatefromyourenterprisecertificate
authority(CA)andtheuploadittotheTSagent.
2. AddaservercertificatetoTSagent.
a. OntheTSagent,selectServer CertificateandclickAdd.
b. Enterthepathandnameofthecertificatefilereceived
fromtheCAorbrowsetothecertificatefile.
c. Entertheprivatekeypassword.
d. ClickOKandthenCommit.
3. Configureandassignthecertificateprofileforthefirewall.
a. SelectDevice > Certificate Management > Certificate
ProfiletoConfigureaCertificateProfile.
Youcanonlyassignonecertificateprofilefor
WindowsUserIDagentsandTSagents.Therefore,
yourcertificateprofilemustincludeallcertificate
authoritiesthatissuedcertificatesuploadedto
connectedWindowsUserIDandTSagents.
b. SelectDevice > User Identification > Connection Security
andclicktheeditbuttontoassignthecertificateprofile.
c. Selectthecertificateprofileyouconfiguredintheprevious
stepfromtheUserIDCertificateProfiledropdown.
d. ClickOK.
e. Commityourchanges.
totheTerminalServicesagenttoreceiveusermappings:
1. SelectDevice > User Identification > Terminal Server Agents
andclickAdd.
2. EnteraNamefortheTerminalServicesagent.
3. EntertheIPaddressoftheWindowsHostonwhichthe
TerminalServicesagentisinstalled.
4. EnterthePortnumberonwhichtheagentwilllistenforuser
mappingrequests.Thisvaluemustmatchthevalueconfigured
ontheTerminalServicesagent.Bydefault,theportissetto
5009onthefirewallandontheagent.Ifyouchangeithere,
youmustalsochangetheListening PortfieldontheTerminal
ServicesagentConfigurescreen.
5. MakesurethattheconfigurationisEnabledandthenclickOK.
6. Committhechanges.
7. VerifythattheConnected statusdisplaysasconnected(a
greenlight).
PaloAltoNetworks,Inc.
UserID MapIPAddressestoUsers

ConfigurethePaloAltoNetworksTerminalServicesAgentforUserMapping(Continued)

Step6 VerifythattheTerminalServicesagentis 1. OpentheWindowsStartmenuandselectTerminal Server

successfullymappingIPaddressesto
usernamesandthatthefirewallscan
connecttotheagent.
Agent.
2. Verifythatthefirewallscanconnectbymakingsurethe
Connection StatusofeachfirewallintheConnectionListis
Connected.
3. VerifythattheTerminalServicesagentissuccessfully
mappingportrangestousernamesbyselectingMonitorinthe
sidemenuandmakingsurethatthemappingtableis
populated.

Step7 (Windows2012R2serversonly)Disable PerformthesestepsontheWindowsServer:

EnhancedProtectedModeinMicrosoft 1. StartInternetExplorer.
InternetExplorerforeachuserwhouses
thatbrowser. 2. SelectInternet options > Advancedandscrolldowntothe
Securitysection.
Thistaskisnotnecessaryforother
browserssuchasGoogleChromeor 3. ClearEnable Enhanced Protected Mode.
MozillaFirefox. 4. ClickOK.
TodisableEnhancedProtected NOTE:InInternetExplorer,PaloAltoNetworksrecommendsthat
Modeforallusers,useLocal youdonotdisableProtectedMode,whichdiffersfromEnhanced
SecurityPolicy. ProtectedMode.

RetrieveUserMappingsfromaTerminalServerUsingthePANOSXMLAPI

ThePANOSXMLAPIusesstandardHTTPrequeststosendandreceivedata.APIcallscanbemadedirectly
fromcommandlineutilitiessuchascURLorusinganyscriptingorapplicationframeworkthatsupports
RESTfulservices.
ToenableanonWindowsterminalservertosendusermappinginformationdirectlytothefirewall,create
scriptsthatextracttheuserloginandlogouteventsandusethemforinputtothePANOSXMLAPIrequest
format.ThendefinethemechanismsforsubmittingtheXMLAPIrequest(s)tothefirewallusingcURLor
wgetandprovidingthefirewallsAPIkeyforsecurecommunication.Creatingusermappingsfrommultiuser
systemssuchasterminalserversrequiresuseofthefollowingAPImessages:
<multiusersystem>SetsuptheconfigurationforanXMLAPIMultiuserSystemonthefirewall.
ThismessageallowsfordefinitionoftheterminalserverIPaddress(thiswillbethesourceaddressforall
usersonthatterminalserver).Inaddition,the<multiusersystem>setupmessagespecifiestherangeof
sourceportnumberstoallocateforusermappingandthenumberofportstoallocatetoeachindividual
useruponlogin(calledtheblocksize).Ifyouwanttousethedefaultsourceportallocationrange
(102565534)andblocksize(200),youdonotneedtosenda<multiusersystem>setupeventtothe
firewall.Instead,thefirewallwillautomaticallygeneratetheXMLAPIMultiuserSystemconfiguration
withthedefaultsettingsuponreceiptofthefirstuserlogineventmessage.
<blockstart>Usedwiththe<login>and<logout>messagestoindicatethestartingsourceport
numberallocatedtotheuser.Thefirewallthenusestheblocksizetodeterminetheactualrangeofport
numberstomaptotheIPaddressandusernameintheloginmessage.Forexample,ifthe<blockstart>
valueis13200andtheblocksizeconfiguredforthemultiusersystemis300,theactualsourceport
rangeallocatedtotheuseris13200through13499.Eachconnectioninitiatedbytheusershouldusea
uniquesourceportnumberwithintheallocatedrange,enablingthefirewalltoidentifytheuserbasedon
itsIPaddressportusermappingsforenforcementofuserandgroupbasedsecurityrules.Whenauser
exhaustsalltheportsallocated,theterminalservermustsendanew<login>messageallocatinganew
portrangefortheusersothatthefirewallcanupdatetheIPaddressportusermapping.Inaddition,a

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 457

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

singleusernamecanhavemultipleblocksofportsmappedsimultaneously.Whenthefirewallreceivesa
<logout>messagethatincludesa<blockstart>parameter,itremovesthecorrespondingIP
addressportusermappingfromitsmappingtable.Whenthefirewallreceivesa<logout>messagewith
ausernameandIPaddress,butno<blockstart>,itremovestheuserfromitstable.And,ifthefirewall
receivesa<logout>messagewithanIPaddressonly,itremovesthemultiusersystemandallmappings
associatedwithit.

TheXMLfilesthattheterminalserversendstothefirewallcancontainmultiplemessagetypes
andthemessagesdonotneedtobeinanyparticularorderwithinthefile.However,upon
receivinganXMLfilethatcontainsmultiplemessagetypes,thefirewallwillprocesstheminthe
followingorder:multiusersystemrequestsfirst,followedbylogins,thenlogouts.

ThefollowingworkflowprovidesanexampleofhowtousethePANOSXMLAPItosendusermappings
fromanonWindowsterminalservertothefirewall.

UsethePANOSXMLAPItoMapNonWindowsTerminalServicesUsers

Step1 GeneratetheAPIkeythat Fromabrowser,logintothefirewall.Then,togeneratetheAPIkeyforthe

willbeusedtoauthenticate firewall,openanewbrowserwindowandenterthefollowingURL:
theAPIcommunication https://<Firewall-IPaddress>/api/?type=keygen&user=<username>&
betweenthefirewallandthe password=<password>

terminalserver.Togenerate Where<Firewall-IPaddress> istheIPaddressorFQDNofthefirewalland

<username> and<password> arethecredentialsfortheadministrativeuser
thekeyyoumustprovide
logincredentialsforan accountonthefirewall.Forexample:
administrativeaccount;the https://10.1.2.5/api/?type=keygen&user=admin&password=admin

APIisavailabletoall Thefirewallrespondswithamessagecontainingthekey,forexample:
administrators(including <response status="success">
rolebasedadministrators <result>
withXMLAPIprivileges <key>k7J335J6hI7nBxIqyfa62sZugWx7ot%2BgzEA9UOnlZRg=</key>
enabled). </result>
NOTE:Anyspecialcharacters </response>
inthepasswordmustbe
URL/percentencoded.

458 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID MapIPAddressestoUsers

UsethePANOSXMLAPItoMapNonWindowsTerminalServicesUsers(Continued)

Step2 (Optional)Generateasetup Thefollowingshowsasamplesetupmessage:

messagethattheterminal
serverwillsendtospecifythe
portrangeandblocksizeof
portsperuserthatyour
terminalservicesagentuses.
Iftheterminalservicesagent
doesnotsendasetup
message,thefirewallwill
automaticallycreatea
TerminalServicesagent
configurationusingthe
followingdefaultsettings
uponreceiptofthefirstlogin startportandendportspecifytheportrangetousewhenassigningportsto
message:
Defaultportrange:1025
to65534
Peruserblocksize:200
Maximumnumberof
multiusersystems:1,000
<uid-message>
<payload>
<multiusersystem>
<entry ip="10.1.1.23" startport="20000"
endport="39999" blocksize="100">
</multiusersystem>
</payload>
<type>update</type>
<version>1.0</version>
</uid-message>
whereentry ipspecifiestheIPaddressassignedtoterminalserverusers,
individualusers,andblocksizespecifiesthenumberofportstoassignto
eachuser.Themaximumblocksizeis4000andeachmultiusersystemcan
allocateamaximumof1000blocks.
Ifyoudefineacustomblocksizeandorportrange,keepinmindthatyoumust
configurethevaluessuchthateveryportintherangegetsallocatedandthat
therearenogapsorunusedports.Forexample,ifyousettheportrangeto
10001499,youcouldsettheblocksizeto100,butnotto200.Thisis
becauseifyousetitto200,therewouldbeunusedportsattheendofthe
range.

Step3 Createascriptthatwill ThefollowingshowstheinputfileformatforaPANOSXMLloginevent:

extractthelogineventsand <uid-message>
createtheXMLinputfileto <payload>
sendtothefirewall.
<login>
Makesurethescriptenforces
<entry name="acme\jjaso" ip="10.1.1.23" blockstart="20000">
assignmentofportnumber
rangesatfixedboundaries <entry name="acme\jparker" ip="10.1.1.23" blockstart="20100">
withnoportoverlaps.For <entry name="acme\ccrisp" ip="10.1.1.23" blockstart="21000">
example,iftheportrangeis </login>
10001999andtheblock </payload>
sizeis200,acceptable
<type>update</type>
blockstartvalueswouldbe
1000,1200,1400,1600,or <version>1.0</version>
1800.Blockstartvaluesof </uid-message>
1001,1300,or1850would Thefirewallusesthisinformationtopopulateitsusermappingtable.Basedon
beunacceptablebecause themappingsextractedfromtheexampleabove,ifthefirewallreceiveda
someoftheportnumbersin packetwithasourceaddressandportof10.1.1.23:20101,itwouldmapthe
therangewouldbeleft requesttouserjparkerforpolicyenforcement.
unused. NOTE:Eachmultiusersystemcanallocateamaximumof1,000portblocks.
NOTE:Theloginevent
payloadthattheterminal
serversendstothefirewall
cancontainmultiplelogin
events.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 459

Copyright 2007-2017 Palo Alto Networks

MapIPAddressestoUsers UserID

UsethePANOSXMLAPItoMapNonWindowsTerminalServicesUsers(Continued)

Step4 Createascriptthatwill ThefollowingshowstheinputfileformatforaPANOSXMLlogoutevent:

extractthelogouteventsand <uid-message>
createtheXMLinputfileto <payload>
sendtothefirewall.
<logout>
Uponreceiptofalogout <entry name="acme\jjaso" ip="10.1.1.23"
eventmessagewitha blockstart="20000">
blockstartparameter,the
<entry name="acme\ccrisp" ip="10.1.1.23">
firewallremovesthe
<entry ip="10.2.5.4">
correspondingIP
</logout>
addressportusermapping.If
thelogoutmessagecontains </payload>
ausernameandIPaddress, <type>update</type>
butnoblockstart <version>1.0</version>
parameter,thefirewall </uid-message>
removesallmappingsforthe NOTE:Youcanalsoclearthemultiusersystementryfromthefirewallusing
user.Ifthelogoutmessage thefollowingCLIcommand:clear xml-api multiusersystem
containsanIPaddressonly,
thefirewallremovesthe
multiusersystemandall
associatedmappings.

Step5 Makesurethatthescripts OnewaytodothiswouldbetousenetfilterNATrulestohideusersessions

youcreateincludeawayto behindthespecificportrangesallocatedviatheXMLAPIbasedontheuid.For
dynamicallyenforcethatthe example,toensurethatauserwiththeuserIDjjasoismappedtoasource
portblockrangeallocated networkaddresstranslation(SNAT)valueof10.1.1.23:2000020099,the
usingtheXMLAPImatches scriptyoucreateshouldincludethefollowing:
theactualsourceport [root@ts1 ~]# iptables -t nat -A POSTROUTING -m owner --uid-owner jjaso
assignedtotheuseronthe -p tcp -j SNAT --to-source 10.1.1.23:20000-20099

terminalserverandthatthe Similarly,thescriptsyoucreateshouldalsoensurethattheIPtablerouting
mappingisremovedwhen configurationdynamicallyremovestheSNATmappingwhentheuserlogsout
theuserlogsoutortheport ortheportallocationchanges:
allocationchanges. [root@ts1 ~]# iptables -t nat -D POSTROUTING 1

Step6 Definehowtopackagethe Toapplythefilestothefirewallusingwget:

XMLinputfilescontainingthe > wget --post file <filename>
setup,login,andlogout
eventsintowgetorcURL Forexample,thesyntaxforsendinganinputfilenamedlogin.xmltothe
messagesfortransmissionto
thefirewall.
https://<Firewall-IPaddress>/api/?type=user-id&key=<key>&file-name=<inp
ut_filename.xml>&client=wget&vsys=<VSYS_name>
firewallat10.2.5.11usingkey
k7J335J6hI7nBxIqyfa62sZugWx7ot%2BgzEA9UOnlZRg usingwgetwould
lookasfollows:
> wget --post file login.xml
https://10.2.5.11/api/?type=user-id&key=k7J335J6hI7nBxIqyfa62sZugWx
7ot%2BgzEA9UOnlZRg&file-name=login.xml&client=wget&vsys=vsys1
ToapplythefiletothefirewallusingcURL:
> curl --form file=@<filename>
https://<Firewall-IPaddress>/api/?type=user-id&key=<key>&vsys=<VSYS_name
>
Forexample,thesyntaxforsendinganinputfilenamedlogin.xmltothe
firewallat10.2.5.11usingkey
k7J335J6hI7nBxIqyfa62sZugWx7ot%2BgzEA9UOnlZRgusingcURLwould
lookasfollows:
> curl --form file@login.xml
https://10.2.5.11/api/?type=user-id&key=k7J335J6hI7nBxIqyfa62sZugWx7ot%
2BgzEA9UOnlZRg&vsys=vsys1

460 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID MapIPAddressestoUsers

UsethePANOSXMLAPItoMapNonWindowsTerminalServicesUsers(Continued)

Step7 Verifythatthefirewallis VerifytheconfigurationbyopeninganSSHconnectiontothefirewalland

successfullyreceivinglogin thenrunningthefollowingCLIcommands:
eventsfromtheterminal ToverifyiftheterminalserverisconnectingtothefirewalloverXML:
servers. admin@PA-5050> show user xml-api multiusersystem
Host Vsys Users Blocks
----------------------------------------
10.5.204.43 vsys1 5 2
Toverifythatthefirewallisreceivingmappingsfromaterminalserverover
XML:
admin@PA-5050> show user ip-port-user-mapping all

Global max host index 1, host hash count 1

XML API Multi-user System 10.5.204.43

Vsys 1, Flag 3
Port range: 20000 - 39999
Port size: start 200; max 2000
Block count 100, port count 20000
20000-20199: acme\administrator

Total host: 1

SendUserMappingstoUserIDUsingtheXMLAPI

UserIDprovidesmanyoutoftheboxmethodsforobtainingusermappinginformation.However,you
mighthaveapplicationsordevicesthatcaptureuserinformationbutcannotnativelyintegratewithUserID.
Forexample,youmighthaveacustom,internallydevelopedapplicationoradevicethatnostandarduser
mappingmethodsupports.Insuchcases,youcanusethePANOSXMLAPItocreatecustomscriptsthat
sendtheinformationtothePANOSintegratedUserIDagentordirectlytothefirewall.ThePANOSXML
APIusesstandardHTTPrequeststosendandreceivedata.APIcallscanbemadedirectlyfromcommand
lineutilitiessuchascURLorusinganyscriptingorapplicationframeworkthatsupportsPOSTandGET
requests.
ToenableanexternalsystemtosendusermappinginformationtothePANOSintegratedUserIDagent,
createscriptsthatextractuserloginandlogouteventsandusetheeventsasinputtothePANOSXMLAPI
request.ThendefinethemechanismsforsubmittingtheXMLAPIrequeststothefirewall(usingcURL,for
example)andusetheAPIkeyofthefirewallforsecurecommunication.Formoredetails,refertothe
PANOSXMLAPIUsageGuide.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 461

Copyright 2007-2017 Palo Alto Networks

EnableUserandGroupBasedPolicy UserID

EnableUserandGroupBasedPolicy

AfteryouEnableUserID,youwillbeabletoconfigureSecurityPolicythatappliestospecificusersand
groups.Userbasedpolicycontrolscanalsoincludeapplicationinformation(includingwhichcategoryand
subcategoryitbelongsin,itsunderlyingtechnology,orwhattheapplicationcharacteristicsare).Youcan
definepolicyrulestosafelyenableapplicationsbasedonusersorgroupsofusers,ineitheroutboundor
inbounddirections.
Examplesofuserbasedpoliciesinclude:
EnableonlytheITdepartmenttousetoolssuchasSSH,telnet,andFTPonstandardports.
AllowtheHelpDeskServicesgrouptouseSlack.
AllowalluserstoreadFacebook,butblocktheuseofFacebookapps,andrestrictpostingtoemployees
inmarketing.

462 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID EnablePolicyforUserswithMultipleAccounts

EnablePolicyforUserswithMultipleAccounts

Ifauserinyourorganizationhasmultipleresponsibilities,thatusermighthavemultipleusernames
(accounts),eachwithdistinctprivilegesforaccessingaparticularsetofservices,butwithalltheusernames
sharingthesameIPaddress(theclientsystemoftheuser).However,theUserIDagentcanmapanyoneIP
address(orIPaddressandportrangeforterminalserverusers)toonlyoneusernameforenforcingpolicy,
andyoucantpredictwhichusernametheagentwillmap.Tocontrolaccessforalltheusernamesofauser,
youmustmakeadjustmentstotherules,usergroups,andUserIDagent.
Forexample,saythefirewallhasarulethatallowsusernamecorp_usertoaccessemailandarulethatallows
usernameadmin_usertoaccessaMySQLserver.Theuserlogsinwitheitherusernamefromthesameclient
IPaddress.IftheUserIDagentmapstheIPaddresstocorp_user,thenwhethertheuserlogsinascorp_user
oradmin_user,thefirewallidentifiesthatuserascorp_userandallowsaccesstoemailbutnottheMySQL
server.Ontheotherhand,iftheUserIDagentmapstheIPaddresstoadmin_user,thefirewallalways
identifiestheuserasadmin_userregardlessofloginandallowsaccesstotheMySQLserverbutnotemail.
Thefollowingstepsdescribehowtoenforcebothrulesinthisexample.

EnablePolicyforaUserwithMultipleAccounts

Step1 Configureausergroupforeachservice Ifyourorganizationalreadyhasusergroupsthatcanaccessthe

thatrequiresdistinctaccessprivileges.
Inthisexample,eachgroupisforasingle
service(emailorMySQLserver).
However,itiscommontoconfigureeach
groupforasetofservicesthatrequire
thesameprivileges(forexample,one
groupforallbasicuserservicesandone
groupforalladministrativeservices).
servicesthattheuserrequires,simplyaddtheusernamethatis
usedforlessrestrictedservicestothosegroups.Inthisexample,
theemailserverrequireslessrestrictedaccessthantheMySQL
server,andcorp_useristheusernameforaccessingemail.
Therefore,youaddcorp_usertoagroupthatcanaccessemail
(corp_employees)andtoagroupthatcanaccesstheMySQLserver
(network_services).
Ifaddingausernametoaparticularexistinggroupwouldviolate
yourorganizationalpractices,youcancreateacustomgroupbased
onanLDAPfilter.Forthisexample,saynetwork_servicesisa
customgroup,whichyouconfigureasfollows:
1. SelectDevice > User Identification > Group Mapping Settings
andAddagroupmappingconfigurationwithauniqueName.
2. SelectanLDAPServer ProfileandensuretheEnabledcheck
boxisenabled.
3. SelecttheCustom GrouptabandAddacustomgroupwith
network_servicesasaName.
4. SpecifyanLDAP FilterthatmatchesanLDAPattributeof
corp_userandclickOK.
5. ClickOKandCommit.
NOTE:Later,ifotherusersthatareinthegroupforlessrestricted
servicesaregivenadditionalusernamesthataccessmorerestricted
services,youcanaddthoseusernamestothegroupformore
restrictedservices.Thisscenarioismorecommonthantheinverse;
auserwithaccesstomorerestrictedservicesusuallyalreadyhas
accesstolessrestrictedservices.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 463

Copyright 2007-2017 Palo Alto Networks

EnablePolicyforUserswithMultipleAccounts
EnablePolicyforaUserwithMultipleAccounts(Continued)
Step2 Configuretherulesthatcontroluser
accessbasedonthegroupsyoujust
configured.
Step3 ConfiguretheignorelistoftheUserID
agent.
ThisensuresthattheUserIDagent
mapstheclientIPaddressonlytothe
usernamethatisamemberofthegroups
assignedtotherulesyoujustconfigured.
Theignorelistmustcontainallthe
usernamesoftheuserthatarenot
membersofthosegroups.
Step4 Configureendpointauthenticationfor
therestrictedservices.
Thisenablestheendpointtoverifythe
credentialsoftheuserandpreservesthe
abilitytoenableaccessforuserswith
multipleusernames.
464 PANOS8.0AdministratorsGuide
Copyright 2007-2017 Palo Alto Networks
UserID
Enableuserandgroupbasedpolicyenforcement.
1. Configureasecurityrulethatallowsthecorp_employees
grouptoaccessemail.
2. Configureasecurityrulethatallowsthenetwork_services
grouptoaccesstheMySQLserver.
Inthisexample,youaddadmin_usertotheignorelistofthe
WindowsbasedUserIDagenttoensurethatitmapstheclientIP
addresstocorp_user.Thisguaranteesthat,whethertheuserlogs
inascorp_useroradmin_user,thefirewallidentifiestheuseras
corp_userandappliesbothrulesthatyouconfiguredbecause
corp_userisamemberofthegroupsthattherulesreference.
1. Createanignore_user_list.txtfile.
2. Openthefileandaddadmin_user.
Ifyoulateraddmoreusernames,eachmustbeonaseparate
line.
3. SavethefiletotheUserIDagentfolderonthedomainserver
wheretheagentisinstalled.
NOTE:IfyouusethePANOSintegratedUserIDagent,see
ConfigureUserMappingUsingthePANOSIntegratedUserID
Agentforinstructionsonhowtoconfiguretheignorelist.
Inthisexample,youhaveconfiguredafirewallrulethatallows
corp_user,asamemberofthenetwork_servicesgroup,tosenda
servicerequesttotheMySQLserver.Youmustnowconfigurethe
MySQLservertorespondtoanyunauthorizedusername(suchas
corp_user)bypromptingtheusertoenterthelogincredentialsof
anauthorizedusername(admin_user).
NOTE:Iftheuserlogsintothenetworkasadmin_user,theuser
canthenaccesstheMySQLserverwithoutitpromptingforthe
admin_usercredentialsagain.
Inthisexample,bothcorp_userandadmin_userhaveemail
accounts,sotheemailserverwontpromptforadditional
credentialsregardlessofwhichusernametheuserenteredwhen
loggingintothenetwork.
Thefirewallisnowreadytoenforcerulesforauserwithmultiple
usernames.
PaloAltoNetworks,Inc.
UserID VerifytheUserIDConfiguration

VerifytheUserIDConfiguration

Afteryouconfigureuserandgroupmapping,enableUserIDinyourSecuritypolicy,andconfigure
Authenticationpolicy,youshouldverifythatUserIDworksproperly.

VerifytheUserIDConfiguration

Step1 AccessthefirewallCLI.

Step2 Verifythatgroupmappingisworking. FromtheCLI,enterthefollowingoperationalcommand:

> show user group-mapping statistics

Step3 Verifythatusermappingisworking. IfyouareusingthePANOSintegratedUserIDagent,youcan

verifythisfromtheCLIusingthefollowingcommand:
> show user ip-user-mapping-mp all
IP Vsys From User Timeout (sec)
------------------------------------------------------
192.168.201.1 vsys1 UIA acme\george 210
192.168.201.11 vsys1 UIA acme\duane 210
192.168.201.50 vsys1 UIA acme\betsy 210
192.168.201.10 vsys1 UIA acme\administrator 210
192.168.201.100 vsys1 AD acme\administrator 748
Total: 5 users
*: WMI probe succeeded

Step4 TestyourSecuritypolicyrule. FromamachineinthezonewhereUserIDisenabled,attempt

toaccesssitesandapplicationstotesttherulesyoudefinedin
yourpolicyandensurethattrafficisallowedanddeniedas
expected.
Youcanalsousethetest security-policy-matchoperational
commandtodeterminewhetherthepolicyisconfigured
correctly.Forexample,supposeyouhavearulethatblocksuser
duanefromplayingWorldofWarcraft;youcouldtestthepolicy
asfollows:
> test security-policy-match application
worldofwarcraft source-user acme\duane source any
destination any destination-port any protocol 6
"deny worldofwarcraft" {
from corporate;
source any;
source-region any;
to internet;
destination any;
destination-region any;
user acme\duane;
category any;
application/service worldofwarcraft;
action deny;
terminal no;
}

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 465

Copyright 2007-2017 Palo Alto Networks

VerifytheUserIDConfiguration UserID

VerifytheUserIDConfiguration(Continued)

Step5 TestyourAuthenticationpolicyand 1. Fromthesamezone,gotoamachinethatisnotamemberof

CaptivePortalconfiguration. yourdirectory,suchasaMacOSsystem,andtrytopingtoa
systemexternaltothezone.Thepingshouldworkwithout
requiringauthentication.
2. Fromthesamemachine,openabrowserandnavigatetoa
websiteinadestinationzonethatmatchesanAuthentication
ruleyoudefined.TheCaptivePortalwebformshoulddisplay
andpromptyouforlogincredentials.
3. Loginusingthecorrectcredentialsandconfirmthatyouare
redirectedtotherequestedpage.
4. YoucanalsotestyourAuthenticationpolicyusingthetest
cp-policy-match operationalcommandasfollows:
> test cp-policy-match from corporate to internet
source 192.168.201.10 destination 8.8.8.8
Matched rule: 'captive portal' action: web-form

Step6 Verifythatthelogfilesdisplay Selectalogspage(suchasMonitor > Logs > Traffic)andverifythat

usernames. theSourceUsercolumndisplaysusernames.

Step7 Verifythatreportsdisplayusernames. 1. SelectMonitor > Reports.

2. Selectareporttypethatincludesusernames.Forexample,the
DeniedApplicationsreport,SourceUsercolumn,should
displayalistoftheuserswhoattemptedtoaccessthe
applications.

466 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID DeployUserIDinaLargeScaleNetwork

DeployUserIDinaLargeScaleNetwork

AlargescalenetworkcanhavehundredsofinformationsourcesthatfirewallsquerytomapIPaddressesto
usernamesandtomapusernamestousergroups.YoucansimplifyUserIDadministrationforsucha
networkbyaggregatingtheusermappingandgroupmappinginformationbeforetheUserIDagentscollect
it,therebyreducingthenumberofrequiredagents.
Alargescalenetworkcanalsohavenumerousfirewallsthatusethemappinginformationtoenforcepolicies.
Youcanreducetheresourcesthatthefirewallsandinformationsourcesuseinthequeryingprocessby
configuringsomefirewallstoacquiremappinginformationthroughredistributioninsteadofdirectquerying.
Redistributionalsoenablesthefirewallstoenforceuserbasedpolicieswhenusersrelyonlocalsourcesfor
authentication(suchasregionaldirectoryservices)butneedaccesstoremoteservicesandapplications(such
asglobaldatacenterapplications).
IfyouConfigureAuthenticationPolicy,yourfirewallsmustalsoredistributetheAuthenticationTimestamps
associatedwithuserresponsestoauthenticationchallenges.Firewallsusethetimestampstoevaluatethe
timeoutsforAuthenticationpolicyrules.Thetimeoutsallowauserwhosuccessfullyauthenticatestolater
requestservicesandapplicationswithoutauthenticatingagainwithinthetimeoutperiods.Redistributing
timestampsenablesyoutoenforceconsistenttimeoutsforeachuserevenifthefirewallthatinitiallygrants
auseraccessisnotthesamefirewallthatlatercontrolsaccessforthatuser.
DeployUserIDforNumerousMappingInformationSources
RedistributeUserMappingsandAuthenticationTimestamps

DeployUserIDforNumerousMappingInformationSources

YoucanuseWindowsLogForwardingandGlobalCatalogserverstosimplifyusermappingandgroup
mappinginalargescalenetworkofMicrosoftActiveDirectory(AD)domaincontrollersorExchangeservers.
ThesemethodssimplifyUserIDadministrationbyaggregatingthemappinginformationbeforetheUserID
agentscollectit,therebyreducingthenumberofrequiredagents.
WindowsLogForwardingandGlobalCatalogServers
PlanaLargeScaleUserIDDeployment
ConfigureWindowsLogForwarding
ConfigureUserIDforNumerousMappingInformationSources

WindowsLogForwardingandGlobalCatalogServers

BecauseeachUserIDagentcanmonitorupto100servers,thefirewallneedsmultipleUserIDagentsto
monitoranetworkwithhundredsofADdomaincontrollersorExchangeservers.Creatingandmanaging
numerousUserIDagentsinvolvesconsiderableadministrativeoverhead,especiallyinexpandingnetworks
wheretrackingnewdomaincontrollersisdifficult.WindowsLogForwardingenablesyoutominimizethe
administrativeoverheadbyreducingthenumberofserverstomonitorandtherebyreducingthenumberof
UserIDagentstomanage.WhenyouconfigureWindowsLogForwarding,multipledomaincontrollers
exporttheirlogineventstoasingledomainmemberfromwhichaUserIDagentcollectstheusermapping
information.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 467

Copyright 2007-2017 Palo Alto Networks

DeployUserIDinaLargeScaleNetwork UserID

YoucanconfigureWindowsLogForwardingforWindowsServerversions2003,2008,2008R2,
2012,and2012R2.WindowsLogForwardingisnotavailablefornonMicrosoftservers.

Tocollectgroupmappinginformationinalargescalenetwork,youcanconfigurethefirewalltoquerya
GlobalCatalogserverthatreceivesaccountinformationfromthedomaincontrollers.
Thefollowingfigureillustratesusermappingandgroupmappingforalargescalenetworkinwhichthe
firewallusesaWindowsbasedUserIDagent.SeePlanaLargeScaleUserIDDeploymenttodetermineif
thisdeploymentsuitsyournetwork.

PlanaLargeScaleUserIDDeployment

WhendecidingwhethertouseWindowsLogForwardingandGlobalCatalogserversforyourUserID
implementation,consultyoursystemadministratortodetermine:
Bandwidthrequiredfordomaincontrollerstoforwardlogineventstomemberservers.Thebandwidthis
amultipleoftheloginrate(numberofloginsperminute)ofthedomaincontrollersandthebytesizeof
eachloginevent.
Notethatdomaincontrollerswontforwardtheirentiresecuritylogs;theyforwardonlytheeventsthat
theusermappingprocessrequiresperlogin:threeeventsforWindowsServer2003orfoureventsfor
WindowsServer2008/2012andMSExchange.
Whetherthefollowingnetworkelementssupporttherequiredbandwidth:

468 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID DeployUserIDinaLargeScaleNetwork

DomaincontrollersMustsupporttheprocessingloadassociatedwithforwardingtheevents.
MemberServersMustsupporttheprocessingloadassociatedwithreceivingtheevents.
ConnectionsThegeographicdistribution(localorremote)ofthedomaincontrollers,member
servers,andGlobalCatalogserversisafactor.Generally,aremotedistributionsupportsless
bandwidth.

ConfigureWindowsLogForwarding

ToconfigureWindowsLogForwarding,youneedadministrativeprivilegesforconfiguringgrouppolicieson
Windowsservers.ConfigureWindowsLogForwardingoneverymemberserverthatwillcollectloginevents
fromdomaincontrollers.Thefollowingisanoverviewofthetasks;consultyourWindowsServer
documentationforthespecificsteps.

ConfigureWindowsLogForwarding

Step1 Oneverymemberserverthatwillcollectsecurityevents,enableeventcollection,addthedomaincontrollers
aseventsources,andconfiguretheeventcollectionquery(subscription).Theeventsyouspecifyinthe
subscriptionvarybydomaincontrollerplatform:
WindowsServer2003TheeventIDsfortherequiredeventsare672(AuthenticationTicketGranted),
673(ServiceTicketGranted),and674(TicketGrantedRenewed).
WindowsServer2008/2012(includingR2)orMSExchangeTheeventIDsfortherequiredeventsare
4768(AuthenticationTicketGranted),4769(ServiceTicketGranted),4770(TicketGrantedRenewed),and
4624(LogonSuccess).
Youmustforwardeventstothesecuritylogslocationonthememberservers,nottothedefault
forwardedlogslocation.Todoso,ontheWindowsEventCollectorthatisreceivingthelogs,youmust
changethelogpathsothattheForwardedEventsarewrittentotheSecuritylogslocation.
1.OpenEventViewerontheWindowsEventCollector.
2.RightclickontheForwardedEventsfolderandselectProperties.
3.Inlogpath,changethepathfrom
%SystemRoot%\System32\Winevt\Logs\ForwardedEvents.evtxto
%SystemRoot%\System32\Winevt\Logs\security.evtx
Toforwardeventsasquicklyaspossible,selecttheMinimize Latencyoptionwhenconfiguringthe
subscription.

Step2 ConfigureagrouppolicytoenableWindowsRemoteManagement(WinRM)onthedomaincontrollers.

Step3 ConfigureagrouppolicytoenableWindowsEventForwardingonthedomaincontrollers.

ConfigureUserIDforNumerousMappingInformationSources

ConfigureUserIDforNumerousMappingInformationSources

Step1 ConfigureWindowsLogForwardingon ConfigureWindowsLogForwarding.Thissteprequires

thememberserversthatwillcollect administrativeprivilegesforconfiguringgrouppolicieson
loginevents. Windowsservers.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 469

Copyright 2007-2017 Palo Alto Networks

DeployUserIDinaLargeScaleNetwork UserID

ConfigureUserIDforNumerousMappingInformationSources(Continued)

Step2 InstalltheWindowsbasedUserID InstalltheWindowsBasedUserIDAgentonaWindowsserver

agent. thatcanaccessthememberservers.Makesurethesystemthatwill
hosttheUserIDagentisamemberofthesamedomainasthe
serversitwillmonitor.

Step3 ConfiguretheUserIDagenttocollect 1. StarttheWindowsbasedUserIDagent.

usermappinginformationfromthe
memberservers.
2. SelectUser Identification > Discoveryandperformthe
followingstepsforeachmemberserverthatwillreceive
eventsfromdomaincontrollers:
a. IntheServerssection,clickAddandenteraNameto
identifythememberserver.
b. IntheServer Addressfield,entertheFQDNorIPaddress
ofthememberserver.
c. FortheServer Type,selectMicrosoft Active Directory.
d. ClickOKtosavetheserverentry.
3. ConfiguretheremainingUserIDagentsettings:see
ConfiguretheWindowsBasedUserIDAgentforUser
Mapping.

Step4 ConfigureanLDAPserverprofileto 1. SelectDevice > Server Profiles > LDAP,clickAdd,andentera

specifyhowthefirewallconnectstothe
GlobalCatalogservers(uptofour)for 2.
groupmappinginformation.
Toimproveavailability,useat
leasttwoGlobalCatalogservers
forredundancy.
Youcancollectgroupmapping
informationonlyforuniversalgroups,
notlocaldomaingroups(subdomains).
Namefortheprofile.
IntheServerssection,foreachGlobalCatalog,clickAddand
entertheserverName,IPaddress(LDAP Server),andPort.
ForaplaintextorStartTransportLayerSecurity(StartTLS)
connection,usePort3268.ForanLDAPoverSSLconnection,
usePort3269.IftheconnectionwilluseStartTLSorLDAP
overSSL,selecttheRequire SSL/TLS secured connection
checkbox.
3. IntheBase DNfield,entertheDistinguishedName(DN)of
thepointintheGlobalCatalogserverwherethefirewallwill
startsearchingforgroupmappinginformation(forexample,
DC=acbdomain,DC=com).
4. FortheType,selectactive-directory.
5. Configuretheremainingfieldsasnecessary:seeAddanLDAP
serverprofile..

Step5 ConfigureanLDAPserverprofileto ThestepsarethesameasfortheLDAPserverprofileyoucreated

specifyhowthefirewallconnectstothe
servers(uptofour)thatcontaindomain
mappinginformation.
UserIDusesthisinformationtomap
DNSdomainnamestoNetBIOSdomain
names.Thismappingensuresconsistent
domain/usernamereferencesinpolicy
rules.
Toimproveavailability,useat
leasttwoserversforredundancy.
forGlobalCatalogsintheStep 4,exceptforthefollowingfields:
LDAP ServerEntertheIPaddressofthedomaincontroller
thatcontainsthedomainmappinginformation.
PortForaplaintextorStartTLSconnection,usePort389.For
anLDAPoverSSLconnection,usePort636.Iftheconnection
willuseStartTLSorLDAPoverSSL,selecttheRequire SSL/TLS
secured connectioncheckbox.
Base DNSelecttheDNofthepointinthedomaincontroller
wherethefirewallwillstartsearchingfordomainmapping
information.Thevaluemuststartwiththestring:
cn=partitions,cn=configuration(forexample,
cn=partitions,cn=configuration,DC=acbdomain,DC=com).

470 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID DeployUserIDinaLargeScaleNetwork

ConfigureUserIDforNumerousMappingInformationSources(Continued)

Step6 Createagroupmappingconfiguration 1. SelectDevice > User Identification > Group Mapping Settings.
foreachLDAPserverprofileyou 2. ClickAddandenteraNametoidentifythegroupmapping
created. configuration.
3. SelecttheLDAPServer ProfileandensuretheEnabledcheck
boxisselected.
4. Configuretheremainingfieldsasnecessary:seeMapUsersto
Groups.
IftheGlobalCataloganddomainmappingservers
referencemoregroupsthanyoursecurityrules
require,configuretheGroup Include Listand/or
Custom Grouplisttolimitthegroupsforwhich
UserIDperformsmapping.
5. ClickOKandCommit.

RedistributeUserMappingsandAuthenticationTimestamps

Everyfirewallthatenforcesuserbasedpolicyrequiresusermappinginformation.Inalargescalenetwork,
insteadofconfiguringallyourfirewallstodirectlyquerythemappinginformationsources,youcan
streamlineresourceusagebyconfiguringsomefirewallstocollectmappinginformationthrough
redistribution.Redistributionalsoenablesthefirewallstoenforceuserbasedpolicieswhenusersrelyon
localsourcesforauthentication(suchasregionaldirectoryservices)butneedaccesstoremoteservicesand
applications(suchasglobaldatacenterapplications).

YoucanredistributeusermappinginformationcollectedthroughanymethodexceptTerminalServices(TS)
agents.YoucannotredistributeGroupMappingorHIPmatchinformation.
IfyouusePanoramaandDedicatedLogCollectorstomanagefirewallsandaggregatefirewalllogs,youcanuse
PanoramatomanageUserIDredistribution.LeveragingPanoramaandyourdistributedlogcollection
infrastructureisasimplersolutionthancreatingextraconnectionsbetweenfirewallstoredistributeUserID
information.

IfyouConfigureAuthenticationPolicy,yourfirewallsmustalsoredistributetheAuthenticationTimestamps
thataregeneratedwhenusersauthenticatetoaccessapplicationsandservices.Firewallsusethe
timestampstoevaluatethetimeoutsforAuthenticationpolicyrules.Thetimeoutsallowauserwho
successfullyauthenticatestolaterrequestservicesandapplicationswithoutauthenticatingagainwithinthe
timeoutperiods.Redistributingtimestampsenablesyoutoenforceconsistenttimeoutsacrossallthe
firewallsinyournetwork.
Firewallsshareusermappingsandauthenticationtimestampsaspartofthesameredistributionflow;you
donthavetoconfigureredistributionforeachinformationtypeseparately.
FirewallDeploymentforUserIDRedistribution
ConfigureUserIDRedistribution

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 471

Copyright 2007-2017 Palo Alto Networks

DeployUserIDinaLargeScaleNetwork UserID

FirewallDeploymentforUserIDRedistribution

ToaggregateUserIDinformation,organizetheredistributionsequenceinlayers,whereeachlayerhasone
ormorefirewalls.Inthebottomlayer,PANOSintegratedUserIDagentsrunningonfirewallsand
WindowsbasedUserIDagentsrunningonWindowsserversmapIPaddressestousernames.Eachhigher
layerhasfirewallsthatreceivethemappinginformationandauthenticationtimestampsfromupto100
redistributionpointsinthelayerbeneathit.Thetoplayerfirewallsaggregatethemappingsandtimestamps
fromalllayers.Thisdeploymentprovidestheoptiontoconfigurepoliciesforallusersintoplayerfirewalls
andregionorfunctionspecificpoliciesforasubsetofusersinthecorrespondingdomainsservedby
lowerlayerfirewalls.
Figure:UserIDandTimestampRedistributionshowsadeploymentwiththreelayersoffirewallsthat
redistributemappingsandtimestampsfromlocalofficestoregionalofficesandthentoaglobaldatacenter.
Thedatacenterfirewallthataggregatesalltheinformationsharesitwithotherdatacenterfirewallssothat
theycanallenforcepolicyandgeneratereportsforusersacrossyourentirenetwork.Onlythebottomlayer
firewallsuseUserIDagentstoquerythedirectoryservers.
TheinformationsourcesthattheUserIDagentsquerydonotcounttowardsthemaximumoftenhopsin
thesequence.However,WindowsbasedUserIDagentsthatforwardmappinginformationtofirewallsdo
count.Therefore,inthisexample,redistributionfromtheEuropeanregiontoallthedatacenterfirewalls
requiresonlythreehops,whileredistributionfromtheNorthAmericanregionrequiresfourhops.Alsointhis
example,thetoplayerhastwohops:thefirsttoaggregateinformationinonedatacenterfirewallandthe
secondtosharetheinformationwithotherdatacenterfirewalls.

Figure:UserIDandTimestampRedistribution

472 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks

UserID DeployUserIDinaLargeScaleNetwork

ConfigureUserIDRedistribution

BeforeyouconfigureUserIDredistribution:
Plantheredistributionarchitecture.Somefactorstoconsiderare:
Whichfirewallswillenforcepoliciesforallusersandwhichfirewallswillenforceregionor
functionspecificpoliciesforasubsetofusers?
HowmanyhopsdoestheredistributionsequencerequiretoaggregateallUserIDinformation?The
maximumallowednumberofhopsisten.
Howcanyouminimizethenumberoffirewallsthatquerytheusermappinginformationsources?
Thefewerthenumberofqueryingfirewalls,thelowertheprocessingloadisonboththefirewalls
andsources.
ConfigureusermappingusingPANOSIntegratedUserIDagentsorWindowsbasedUserIDAgents.
ConfigureAuthenticationPolicy.
PerformthefollowingstepsonthefirewallsintheUserIDredistributionsequence.

ConfigureUserIDRedistribution

Step1 Configurethefirewalltoredistribute 1. SelectDevice > User Identification > User Mapping.

UserIDinformation.
Skipthisstepifthefirewallreceivesbut
doesnotredistributeUserID
information.
2. (Firewallswithmultiplevirtualsystemsonly)Selectthe
Location.YoumustconfiguretheUserIDsettingsforeach
virtualsystem.
Youcanredistributeinformationamongvirtual
systemsondifferentfirewallsoronthesamefirewall.
Inbothcases,eachvirtualsystemcountsasonehopin
theredistributionsequence.
3. EditthePaloAltoNetworksUserIDAgentSetupandselect
Redistribution.
4. EnteraCollector NameandPre-Shared Keytoidentifythis
firewallorvirtualsystemasaUserIDagent.
5. ClickOKtosaveyourchanges.

Step2 Configuretheserviceroutethatthe 1. SelectDevice > Setup > Services.

firewallusestoqueryotherfirewallsfor 2.
UserIDinformation.
Skipthisstepifthefirewallreceivesuser
mappinginformationfrom
WindowsbasedUserIDagentsor
directlyfromtheinformationsources
(suchasdirectoryservers)insteadof
fromotherfirewalls.
(Firewallswithmultiplevirtualsystemsonly)SelectGlobal
(forafirewallwideserviceroute)orVirtual Systems(fora
virtualsystemspecificserviceroute),andthenconfigurethe
serviceroute.
3. ClickService Route Configuration,selectCustomize,and
selectIPv4orIPv6basedonyournetworkprotocols.
Configuretheservicerouteforbothprotocolsifyournetwork
usesboth.
4. SelectUID AgentandthenselecttheSource Interfaceand
Source Address.
5. ClickOKtwicetosavetheserviceroute.

Step3 Enablethefirewalltorespondwhen ConfigureanInterfaceManagementprofilewiththeUser-ID

otherfirewallsqueryitforUserID serviceenabledandassigntheprofiletoafirewallinterface.
information.
Skipthisstepifthefirewallreceivesbut
doesnotredistributeUserID
information.

PaloAltoNetworks,Inc. PANOS8.0AdministratorsGuide 473

Copyright 2007-2017 Palo Alto Networks

DeployUserIDinaLargeScaleNetwork UserID

ConfigureUserIDRedistribution(Continued)

Step4 Commitandverifyyourchanges. 1. Commityourchangestoactivatethem.

2. AccesstheCLIofafirewallthatredistributesUserID
information.
3. Displayalltheusermappingsbyrunningthefollowing
command:
> show user ip-user-mapping all
4. RecordtheIPaddressassociatedwithanyusername.
5. AccesstheCLIofafirewallthatreceivesredistributedUserID
information.
6. Displaythemappinginformationandauthentication
timestampforthe<IP-address> yourecorded:
> show user ip-user-mapping ip <address>
IP address: 192.0.2.0 (vsys1)
User: corpdomain\username1
From: UIA
Idle Timeout: 10229s
Max. TTL: 10229s
MFA Timestamp: first(1) - 2016/12/09 08:35:04
Group(s): corpdomain\groupname(621)
NOTE:Thisexampleoutputshowstheauthentication
timestampforoneresponsetoanauthenticationchallenge
(factor).ForAuthenticationpolicyrulesthatuseMultiFactor
Authentication(MFA),theoutputshowsmultiple
AuthenticationTimestamps.

474 PANOS8.0AdministratorsGuide PaloAltoNetworks,Inc.

Copyright 2007-2017 Palo Alto Networks