Map IP Addresses to Users

User-ID provides many different methods for mapping IP addresses to usernames. Before you begin configuring user mapping, consider where your users are logging in from, what services they are accessing, and what applications and data you need to control access to. This will inform which types of agents or integrations would best allow you to identify your users.

Once you have your plan, you can begin configuring user mapping using one or more of the following methods as needed to enable user-based access and visibility to applications and resources:

• If you have users with client systems that aren't logged in to your domain servers—for example, users running Linux clients that don't log in to the domain—you can  Map IP Addresses to Usernames Using Authentication Portal . Using Authentication Portal in conjunction with  Authentication Policy  also ensures that all users authenticate to access your most sensitive applications and data.
• To map users as they log in to your Exchange servers, domain controllers, eDirectory servers, or Windows clients you must configure a User-ID agent :
  • Configure User Mapping Using the PAN-OS Integrated User-ID Agent
  • Configure User Mapping Using the Windows User-ID Agent
• If you have clients running multi-user systems in a Windows environment, such as Microsoft Terminal Server or Citrix Metaframe Presentation Server or XenApp,  Configure the Palo Alto Networks Terminal Server (TS) Agent for User Mapping . For a multi-user system that doesn't run on Windows, you can  Retrieve User Mappings from a Terminal Server Using the PAN-OS XML API .
• To obtain user mappings from existing network services that authenticate users—such as wireless controllers, 802.1x devices, Apple Open Directory servers, proxy servers, or other Network Access Control (NAC) mechanisms— Configure User-ID to Monitor Syslog Senders for User Mapping .

High-Level Method Selection Flow

graph TD
    A[Identify User Type/Environment] --> B{Client OS?}
    B -- Windows Domain Client --> C[Use User-ID Agent Windows or Integrated]
    B -- Linux/Non-Domain Client --> D{Need Web Auth?}
    D -- Yes --> E[Use Authentication Portal]
    D -- No --> F[Consider XML API or Syslog]
    B -- Multi-User Windows (Citrix/TS) --> G[Use TS Agent]
    B -- Multi-User Non-Windows --> H[Use XML API for Terminal Servers]
    A --> I{Existing Auth Service?}
    I -- Yes (Wireless Controller, NAC, Proxy) --> J[Monitor Syslog Senders]
    I -- No --> K[Choose Agent or Auth Portal based on OS]
    A --> L{Custom Application?}
    L -- Yes --> M[Use XML API for General]

        

While you can configure either the Windows agent or the PAN-OS integrated User-ID agent on the firewall to listen for authentication syslog messages from the network services, because only the PAN-OS integrated agent supports syslog listening over TLS, it is the preferred configuration.

• To include the username and domain in the headers for outgoing traffic so other devices in your network can identify the user and enforce user-based policy, you can Insert Username in HTTP Headers.
• To  Share User-ID Mappings Across Virtual Systems , you can configure a virtual system as a User-ID hub.
• For other clients that you can't map using the other methods, you can  Send User Mappings to User-ID Using the XML API .
• A large-scale network can have hundreds of information sources that firewalls query for user and group mapping and can have numerous firewalls that enforce policies based on the mapping information. You can simplify User-ID administration for such a network by aggregating the mapping information before the User-ID agents collect it. You can also reduce the resources that the firewalls and information sources use in the querying process by configuring some firewalls to redistribute the mapping information . For details, see Deploy User-ID in a Large-Scale Network.

Create a Dedicated Service Account for the User-ID Agent

To use the Windows-based User-ID agent or the PAN-OS integrated User-ID agent to map users as they log in to your Exchange servers, domain controllers, eDirectory servers, or Windows clients, create a dedicated service account for the User-ID agent on a domain controller in each domain that the agent will monitor.

Service Account Creation & Permission Flow

flowchart TD
    A[Log in to Domain Controller] --> B(Open Active Directory Users & Computers)
    B --> C{Create New User Account}
    C --> D[Define Username/Password]
    D --> E{Assign Required Permissions}
    E -- Windows Agent --> F[Logon as Service Local/GPO and Event Log Readers and DCOM Users Optional for WMI and CIMV2 Optional for WMI and Folder/Registry Permissions]
    E -- PAN-OS Agent --> G[Event Log Readers and Server Operator Optional for Session Mon and DCOM Users Optional for WMI and CIMV2 Optional for WMI]
    F --> H{Deny Unnecessary Permissions}
    G --> H
    H --> I[Deny Interactive Logon and Deny Remote Access]
    I --> J(Service Account Ready)

        

The User-ID agent maps users based on logs for security events. To ensure that the User-ID agent can successfully map users, verify that the source for your mappings generates logs for Audit Logon, Audit Kerberos Authentication Service, and Audit Kerberos Service Ticket Operations events. At a minimum, the source must generate logs for the following events:

• Logon Success (4624)
• Authentication Ticket Granted (4768)
• Service Ticket Granted (4769)
• Ticket Granted Renewed (4770)

The required permissions for the service account depend on the user mapping methods and settings you plan to use. For example, if you are using the PAN-OS integrated User-ID agent, the service account requires Server Operator privileges to monitor user sessions. If you are using the Windows-based User-ID agent, the service account does not require Server Operator privileges to monitor user sessions. To reduce the risk of compromising the User-ID service account, always configure the account with the minimum set of permissions necessary for the agent.

• If you are installing the Windows-based User-ID agent on a supported Windows server, Configure a Service Account for the Windows User-ID Agent.

• If you are using the PAN-OS integrated User-ID agent on the firewall, Configure a Service Account for the PAN-OS Integrated User-ID Agent.

User-ID provides many methods for safely collecting user mapping information. Some legacy features designed for environments that only required user mapping on Windows desktops attached to the local network require privileged service accounts. If the privileged service account is compromised, this would open your network to attack. As a best practice, avoid using legacy features that require privileges that would pose a threat if compromised, such as client probing and session monitoring.