Identity Redistribution (Strata Cloud Manager)

Table of Contents

Filter

Expand All | Collapse All

Prisma Access Docs

Activation & Onboarding
Administration
Version
- Prisma Access China
- 4.0 & Later
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred
Integrations
Incidents & Alerts
Release Notes
Version
- 5.2 Preferred and Innovation
- 5.1 Preferred and Innovation
- 5.0 Preferred and Innovation
- 4.2 Preferred
- 4.1 Preferred
- 4.0 Preferred
- 3.2 Preferred and Innovation
- 3.1 Preferred and Innovation
- 3.0 Preferred and Innovation
- 2.2 Preferred

Identity Redistribution (Strata Cloud Manager)

So that you can enforce your security policy consistently, Prisma Access shares identity data that GlobalProtect discovers locally across your entire Prisma Access environment. Prisma Access can also share identity data with on-premises devices at remote network sites or service connection sites (HQ and data centers).

For Prisma Access (Managed by Strata Cloud Manager), we’ve enabled some identity data redistribution by default, and for what’s left, we’ve made the configuration to enable redistribution very simple (just select a checkbox to select what data you want to share).

From the Identity Distribution dashboard, you can see how identity data is being shared and manage data redistribution (ManageConfigurationNGFW and Prisma AccessIdentity Services.

Identity data that you can redistribute includes:

HIP data
IP-address-to-tag mappings
IP-address-to-user mappings
User-to-tag mappings
Quarantined devices

Get started with identity redistribution:

Set Up Identity Redistribution

Set Up Identity Redistribution

Confirm Your Service Connection Setup.

If you haven’t yet set up a service connection for your HQ or data centers, begin by configuring a service connection. A service connection is required for Prisma Access to share identity data across your environment; Prisma Access automatically enables service connections to work as redistribution agents. A newly created service connection site will be ready to be used as a redistribution agent when you see that it's been assigned a User-ID agent Address (Prisma Access does this automatically, and it'll just take a few minutes).

User-ID Redistribution Management—Sometimes, granular controls are needed for user-ID redistribution in particularly large scale Prisma Access deployments. User-ID Redistribution Management lets you manually disable the default identity redistribution behavior for certain service connections by removing the check mark in the User ID column, and then select specific service connections to be used for identity redistribution. It's not necessary to do this for most configurations. Contact Palo Alto Networks support to activate this functionality.

Go to ManageConfigurationNGFW and Prisma AccessIdentity ServicesIdentity Redistribution set the configuration scope to Service Connections to verify the service connection User-ID agent details.
Send Identity Data from Prisma Access to on-premises Devices.

The service connection’s User-ID agent information is all you need to configure Prisma Access to distribute identity data to on-premises devices.

Go to ManageConfigurationNGFW and Prisma AccessIdentity ServicesIdentity Redistribution set the configuration scope to Service Connections to get the service connection User-ID agent details.

Use these details to configure Prisma Access as a data redistribution agent on Panorama or a Palo Alto Networks NGFW.
Send Identity Data from on-premises Devices to Prisma Access.

Add on-premises devices to Prisma Access as redistribution agents; the devices you add will be able to distribute identity data to Prisma Access.
- From devices at remote network sites:
  
  Go to the Identity Redistribution dashboard, set the configuration scope to Remote Networks, and Add Agent. In addition to specifying the host details, select the type of data the device shares with Prisma Access. Optional settings include the name and a pre-shared key for the device.
- From devices at service connection sites:
  
  Go to the Identity Redistribution dashboard, set the configuration scope to Service Connections, and Add Agent. In addition to specifying the host details, select the type of data the device shares with Prisma Access. Optional settings include the name and a pre-shared key for the device.
Configure the Terminal Server agent for User Mapping.

The Terminal Server (TS) agent allocates a port range to each user to identify specific users on Windows-based terminal servers. The TS agent notifies Prisma Access of the allocated port ranges, so that Prisma Access can enforce policy based on users and user groups.

On the Identity Redistribution dashboard, set the configuration scope to Remote Networks, and Add Terminal Server Agent under Terminal Server Sending to Remote Networks Nodes.
- By default, the configuration is Enabled.
- Enter a Name for the TS agent.
- Enter the IP address of the Windows Host on which the TS agent is installed.
- Enter the Port number on which the agent listens for user mapping requests. The port is set to 5009 by default.
- Save your changes.
Distribute Identity Data Across Your Prisma Access Environment.

On the Identity Redistribution dashboard, Edit the diagram to specify the identity data you want to collect from each source and share across Prisma Access.
To activate your changes, push the configuration to Prisma Access.