Configure Third-Party Device-ID in Prisma Access (Strata Cloud Manager)

1. Activate Third-Party Device-ID in the Cloud Identity Engine.

   This procedure includes uploading a signed certificate and using that with an API to communicate with, and download Device-ID information from, the third-party IoT vendor.
2. Activate Third-Party Device-ID in Prisma Access in Strata Cloud Manager by going to ConfigurationNGFW and Prisma AccessConfiguration ScopePrisma AccessSetupInfrastructure Settings, enable Device Identification, and choose where to enable Device Identification from the dropdown: Remote Networks, Mobile Users, or Both.

3. Configure a device object and enter device attributes. Go to ConfigurationNGFW and Prisma Access, set the configuration scope to Mobile Users or Remote Networks, and select ObjectsDevices and Add Devices. Be sure that you are in the Mobile Users or Remote Networks device group.

   1. Add a device object that matches attributes for the third-party objects.

      The Cloud Identity Engine Mappings area displays the attributes of the third-party devices; you can use any attributes retrieved from there.
4. Go to ConfigurationNGFW and Prisma Access, set the configuration scope to Mobile Users or Remote Networks, select Security ServicesSecurity Policy, and Add a security policy, adding the device objects you created in the Devices area.

   If you're configuring a Security policy rule for a remote network or shared device group, you can add the device objects you created to SourceDevices or to DestinationDevices.

   If you're configuring a Security policy rule for mobile users, you can only use device objects for destination devices. Add the device objects you created to DestinationDevices.

5. Push Config to save your changes to the Prisma Access configuration, making sure to select Mobile Users or Remote Networks in the push scope.
6. Verify that Prisma Access is receiving the Device-ID logs by going to Incidents & AlertsLog Viewer, selecting Firewall/Traffic, and searching for traffic under the rule you created by entering rule_matched = rulename, where rulename is the security policy rule you created for the third-party IoT devices.

   The Device-ID to IP address mappings display in the logs.