Long-Form Distinguished Name Entries
If you have not configured a next-generation firewall
as a
master device or
configured a
Cloud Identity Engine to populate
users and groups in security policy rules, you can use long-form
distinguished name (DN) entries in Panorama instead.
Prisma Access
uses the DN entries to evaluate the User-ID-based policies you have
configured in Panorama.
For example, given a User named Bob Alice who
works in IT and is located on the first floor, a matching security
policy may have cn=first_floor, ou=it_staff, dc=dev, dc=example,
dc=com if the policy is to be applied to all IT staff
on the first floor, or cn=Bob Alice, ou=it_staff, dc=dev,
dc=example, dc=com if the policy is only to be applied
to Bob Alice.