By default security policy in the Palo Alto Firewalls supports configuration based on source and destination address, type of application or port used as part of the default service. This can be extended to support rules based on a users CalNet ID in some situations.
User-ID
The system used by the Palo Alto Networks equipment to connects source IP addresses to user names. This allows firewall policy to be written allowing only known users access.
How it Works
- Security policy including a list of users matches other requirements (such as source and destination address)
- The VSYS queries the User-ID system with the source network address of the connection
- If there is a username matching the source address in User-ID the name is returned to the VSYS
- The username returned is compared to the allowed list specified in the policy and the VSYS takes the appropriate action
When a policy entry matches other requirements (such as source and destination address and application) and specifies usernames the system will then query the U
Limitations
- User-ID only works with active users of the bSecure remote access service (GlobalProtect)
- User-ID does not work with group membership
- The User field must be filled out manually (usernames cannot be searched)
- The User field only accepts the short CalNET ID (joeuser) and not any other form of user identification
Requesting Access
User-ID is not enabled by default must be configured by the Network Operations group to activate the feature on a specific VSYS.
- Connect to the Telecom Catalogue (TelCat)
- Select Data Network Service
- Select bSecure - Departmental Firewall
- Select Existing Firewall for the Is this for a new or existing firewall service? question
- In the request field provide the name of the VSYS and note that you would like it enabled for User-ID
Using User-ID
An administrator starts by configuring security policy that will be used specifically for User-ID. After configuring the other required fields (source and destination, application, etc.) you then manually enter a list of CalNet ID's in the Users tab.
(Policy-User-Field.png)
Logging must be enabled on the policy entry for you to verify results in the log. Commit your policy and then push it to your VSYS.
Once it is in place you can see the matched usernames in the Monitor tab for your log entries.
(Monitor-Source-User.png)
If you do not see the Source User column you need to configure the system to display it by clicking on the pulldown next to any existing column, select columns, and then selecting Source User.
(Monitor-User-Column.png)