Upgrading User-ID. Tech Note PAN-OS , Palo Alto Networks, Inc.

Transcription

1 Upgrading User-ID Tech Note PAN-OS 4.1 Revision B 2011, Palo Alto Networks, Inc.

2 Overview PAN-OS 4.1 introduces significant improvements in the User-ID feature by adding support for multiple user directories, Active Directory Global Catalog and multi domain setups. As part of this new feature set, some functionality of User-ID that has been part of the User-ID Agent has now been moved into the firewall itself. With this change, certain manual steps are required to fully migrate and upgrade to the new User-ID feature set introduced in PANOS 4.1. This document describes the steps a customer needs to go through to successfully upgrade to take full advantage of these improvements. PAN-OS 4.1 still remains backwards compatible with PAN-OS release 3.1 of the User-ID Agent without limitation. Meaning, if you only want to migrate your firewall to the latest PAN-OS version, but do not want to take advantage of the new User-ID features, you can leave the already installed User-ID Agent untouched and just upgrade your firewall without any functionality loss. Users and Groups Retrieval of user group information in PAN-OS 4.1 is done on the firewall entirely. For this purpose, the firewall connects to your directory service and servers through LDAP and retrieves the necessary user and group object information. This section covers the configuration of PAN-OS for this feature. LDAP Server Profiles As the first step, you need to configure one or more directory servers that the firewall will use to retrieve the user and group information. This is done in the Device > Server Profiles > LDAP section of the management user interface. 1. Name your configuration and leave the Administrator use only checkbox unchecked. 2. List the directory servers that you want the firewall to use in the server list. You need to provide at least one server; two or more are recommended for failover purposes. The standard LDAP port for this configuration is Leave the Domain field empty, unless you want to configure multiple independent directories. 4. Select a directory Type. Based on the selected directory type, the firewall can populate default values for attributes and objectclasses used for user and group objects in the directory server. 5. Enter the base of the LDAP directory in the Base field. For example, if your Active Directory Domain is acme.local, your base would be dc=acme,dc=local, unless you want to leverage an Active Directory Global Catalog. 2011, Palo Alto Networks, Inc. [2]

3 6. In the Bind DN field, enter a user name for a user with sufficient permission to read the LDAP tree. In an Active Directory environment, a valid username for this entry could be the User Principal Name, e.g. [email protected] but also the users distinguished name, e.g. cn=administrator,cn=users,dc=acme,dc=local. 7. Enter and confirm the authentication password for the user account that you entered above. Identifying the Directory Base LDAP Server profile configuration In case you have difficulties identifying your directory base DN, you can simply follow these steps: 1. Open the Active Directory Users and Groups management console on your domain controller. 2. Select Advanced features in the View menu of the management console. 3. Select the top of your domain object and select Properties. 4. Navigate to the Attribute Editor in the properties window and scroll to the distinguishedname attribute. 5. Copy the content of this attribute into the LDAP Server configuration Base field in the firewall management UI. 2011, Palo Alto Networks, Inc. [3]

4 Group Mapping Settings Active Directory Advanced Property View After the LDAP server has been configured, you need to configure how groups and users are retrieved from the directory and which users groups are to be included in policies. In order to create a new group mapping entry, navigate to the Device > User Identification menu and create a new entry under the Group Mapping Settings tab. Server Profile In this configuration, you specify which LDAP server profile is going to be used to identify users and groups. Select the LDAP Server Profile you configured earlier in the LDAP Server Profile section in the drop-down list under Server Profile. All LDAP Attributes and ObjectClasses will be pre-populated based on the directory server type you selected in the LDAP Server Profile. Under normal circumstances, you should not have to modify any of these attributes. Please refer to the Palo Alto Networks Administrator s Guide for customizations of these attributes. 2011, Palo Alto Networks, Inc. [4]

5 The default update interval for changes in user groups is 3600 seconds (1 hour). You can customize this value to a shorter period if needed. Group Include List In order to optimize LDAP queries and policy configuration, you can specify a list of user groups you would like to include in policies in the Group Mapping Settings. PAN-OS will restrict its queries to the groups listed in order to track changes in the group members. 1. Select the groups you would like to add in the tree view on the right hand side, which represents the directory structure and shows all user groups. You can search for available groups using the search field. Pattern matching is performed by adding asterisks to the beginning or end of the string. 2. Add groups you want to include in policy by selecting them in the right tree view and clicking the + button. 3. Click ok to save the group mappings. 2011, Palo Alto Networks, Inc. [5]

6 Users and IP Addresses The new User-ID Agent adds a variety of new features, such as monitoring of Microsoft Exchange Server logon events. All settings of the previous 3.1 User-ID Agent are automatically migrated into the new User Identification Agent. All configured User-ID Agents settings in PANOS are automatically migrated to the User-ID Agent list in PANOS , Palo Alto Networks, Inc. [6]