Configure User-ID with GlobalProtect Cloud Service

To map IP addresses to user IDs for mobile users and users at remote network locations when they log in, you must configure User-ID for the GlobalProtect cloud service. The tasks you perform to configure User-ID for the GlobalProtect cloud service are similar to configuring User-ID for on-premise Palo Alto Networks next-generation firewalls.
Use the following workflow to configure User-ID for the GlobalProtect cloud service.
  1. Map IP Addresses to Users in the GlobalProtect cloud service.

Configure User-ID for the GlobalProtect Cloud Service Using the PAN-OS Integrated User-ID Agent

The following procedure shows how to configure the PAN-OS integrated User-ID agent on the firewall for IP address-to-username mapping. The integrated User-ID agent performs the same tasks as the Windows-based agent with the exception of NetBIOS client probing (WMI probing is supported).
  1. Create the User-ID service account in the Windows Active Directory (AD) server that is being used by the authentication server.
    Be sure that the user you create is part of the following groups:
    • Distributed COM Users
    • Event Log Readers
      If you are configuring the account in Windows 2003, the Event Log Readers group does not exist; instead, create a group policy and give the user Audit and manage security log permissions.
    • Server Operators
    agentless-user-id-userid-user.png
    We recommend only making these group associations. You do not have to configure Domain Admin or Enterprise Admin privileges for the User-ID service account to work correctly. Giving privileges to the account that aren’t required can give your network a larger attack surface.
  2. Configure Windows Management Instrumentation (WMI) on the AD server.
    The device uses WMI Authentication and you must modify the CIMV2 security properties on the AD server that connects to the device.
    1. Open a command prompt window and run the wmimgmt.msc command.
    2. In the WMI Control pane, right-click WMI Control, choose Properties, and select the Security tab.
      agentless-user-id-wmi-properties.png
  3. Make the following changes in the CIMV2 folder:
    1. Select the CIMV2 folder.
    2. Click Security.
    3. Click Add
    4. Select the service account you created in Step 1 .
      This example uses the UserID user with the email of userid@example.com.
    5. Check Allow for the Enable Account and Remote Enable for the account you created.
    6. Click Apply.
    7. Click OK.
      agentless-user-id-cimv2-config.png
  4. In Panorama, select DeviceUser IdentificationUser Mapping and click the gear icon to edit the settings.
    agentless-user-id-user-mapping-edit-settings.png
  5. Make the following changes to the Palo Alto Networks User-ID Agent Setup settings:
    1. Select WMI Authentication and enter the domain and username (in the format domain/username) for the User-ID service account, along with a valid password.
      agentless-user-id-wmi-authentication.png
    2. (Optional) Select Server Monitor and change the default settings, if required.
      • To disable security log monitoring on Windows servers, deselect Enable Security Log.
      • To enable monitoring of user sessions on the monitored servers, select Enable Session.
    3. (Optional) Select Client Probing and select Enable Probing to enable WMI probing.
    4. Click OK to exit from the Palo Alto Networks User-ID Agent Setup.
  6. If you have not done so already, click Add in the Server Monitoring area and add a Name, Description, Type, and Network Address for the server you need to monitor.
    agentless-user-id-user-id-monitored-server.png
  7. Confirm that the server is connected.
    • To confirm using CLI commands, enter the show user server-monitor statistics command.
      username@hostname> show user server-monitor statistics
      Directory Servers:  
      Name                        TYPE    Host        Vsys    Status           
      ---------------------------------------------------------------   
      exampleadserver.example.com  AD exampleadserver.example.com vsys1 Connected
    • To confirm using Panorama, check the Status of the server.
      agentless-user-id-server-monitoring-status.png

Related Documentation