background image

4

| Palo Alto Networks User-ID Services 

 

Amigopod 

|Technical Note 

       

1

 

Introduction 

This technical note demonstrates how Palo Alto Networks customers can leverage 
Amigopod to provide User Identity tracking for both known corporate users (via Active 
Directory, eDirectory etc) and now Guest &/or Public Access users accessing the Internet 
through their Guest Access or Hotspot networks. 

Audience 

This document is intended for network administrators and system integrators deploying an 
Amigopod-based visitor management solution in conjunction with a Palo Alto Networks 
Next Generation firewall.  

Basic familiarity with the Amigopod Visitor Management Appliance is assumed. For in-
depth information about the features and functions of the Amigopod appliance, refer to the 
Amigopod Deployment Guide.  

Some familiarity with the Palo Alto Networks firewall range is assumed, including 
knowledge of their User-ID technology, Virtual-Wire deployment mode and their web 
based User Interface. 

Document Overview 

The first section of this document describes how the Amigopod Visitor Management 
Appliance can be used to provide end-user identity visibility to many of the Palo Alto 
Networks Policy and Reporting features built on top of their core User-ID technology. 

The next section contains a detailed configuration guide for administrators intending to 
deploy Palo Alto Networks User-ID Services on the Amigopod Visitor Management 
Appliance. Step-by-step instructions for configuring and validating a configuration are 
provided. 

Disclaimer 

The topics of network design, security architectures and visitor access are complex 
subjects, and no single document can hope to cover all of the possible combinations of 
network equipment, network design, deployment requirements, and device configurations, 
nor can all the possible security implications for a particular recommendation be covered. 

Therefore, while you read this document, it is best to consider it as a guide to developing 
your own understanding of the network design topics covered, and as a basis for further 
investigation. 

Summary of Contents for Palo Alto Networks

Page 1: ...Palo Alto Networks User ID Services Unified Visitor Management...

Page 2: ...es The Open Source code used can be found at this site http www arubanetworks com open_source Legal Notice The use of Aruba Networks Inc switching platforms and software by all individuals or corporat...

Page 3: ...figuring the Palo Alto Networks User ID Service 9 Check Palo Alto Networks Version and Setup 10 Configuring User ID Agent Definition 11 Enable Zone Based User Identification 12 Configuring User ID Age...

Page 4: ...t mode and their web based User Interface Document Overview The first section of this document describes how the Amigopod Visitor Management Appliance can be used to provide end user identity visibili...

Page 5: ...ies IT organizations can leverage user and group information for visibility policy creation forensic investigation and reporting on application threat web surfing and data transfer activity User ID he...

Page 6: ...d with the source Enterprise user s identity by integrating with Active Directory or Novell eDirectory for example Typical Wired and Wireless Access Controllers have basic firewalling and traffic mana...

Page 7: ...e Directory integration the User ID Agent is installed on a domain workstation or server and uses a domain account that has access to the Active Directory tree For the Amigopod integration the User ID...

Page 8: ...ins link to download and install updated plugins It is assumed that the configuration steps required to integrate the chosen Wired or Wireless Access Controller have been completed tested and known to...

Page 9: ...cess Controller must be configured correctly to support RADIUS accounting otherwise the Palo Alto Networks firewall will not be updated with the real time user identity information 3 Configure the fol...

Page 10: ...egment by binding two ports together You can install the firewall in any network environment with no configuration of adjacent network devices required If necessary a virtual wire can block or allow t...

Page 11: ...t the Windows host has an IP Address of 10 0 20 53 A port must also be defined for communications between the Palo Alto Networks firewall and the User ID Agent software on the Windows host Ensure to m...

Page 12: ...estion and ensure the Enable User Identification option shown below is checked Once you have edited each relevant Zone in your deployment the summary table should look similar to this with the User Id...

Page 13: ...nt menu option The following start up screen will be displayed Click the Configure option in the left navigation pane to complete the configuration of the Agent software From the Configure screen the...

Page 14: ...returning to main screen by clicking on the User ID Agent option at the top of the left navigation pane a successful connection from the Palo Alto Networks firewall should be displayed as shown below...

Page 15: ...details for a new test account and click the Create Guest button to save the account to the Amigopod database Login to Guest Wireless Network Verify Wireless Connection and IP Addressing The next step...

Page 16: ...ted to a configured landing page or onto your original destination Verify Successful RADIUS Authentication You can now verify the successful RADIUS authentication from the Amigopod interface by going...

Page 17: ...l to the User ID Agent software to inform the Palo Alto Networks of the new IP Address to User mapping Returning to the main screen of the User ID Agent we can see that the Amigopod has successfully s...

Page 18: ...ffic analysis You should now see the From User column successfully populated with the user identity of the test user created in Amigopod One of the most powerful sections of the Palo Alto Networks use...

Page 19: ...d hence initiate at RADIUS stop record being sent from the Access Controller to the Amigopod This will trigger another API update from the Amigopod to the User ID Agent running on the Windows host Ret...

Page 20: ...egrated solution to both the operational and security requirements of providing network access to non Active Directory users In the corporate environment nontechnical operators can easily provision te...

Reviews: