8.1 User-ID Architecture, Agentless/Agent Deployment, and Cloud Identity Engine (CIE)

8.1 User-ID Architecture, Agentless/Agent Deployment, and Cloud Identity Engine (CIE)

Quick Answer: Palo Alto Networks User-ID technology transforms network security by binding IP addresses to corporate user identities and directory groups. Instead of constructing security policies around static IP addresses, PAN-OS parses authentication telemetry from Active Directory domain controllers, Syslog messages, Exchange servers, Terminal Services agents, and API calls. For cloud-first organizations, the Cloud Identity Engine (CIE) synchronizes cloud identity providers (Microsoft Entra ID, Okta, Google Workspace) via SCIM 2.0 and Graph API, delivering cloud-native group membership and identity mapping without requiring local LDAP infrastructure or complex WAN tunnels.

Traditional IP-based firewall policies are fundamentally flawed in modern enterprise networks dominated by Dynamic Host Configuration Protocol (DHCP), mobility, Virtual Desktop Infrastructure (VDI), and cloud identity providers. An IP address represents a network interface, not an authenticated person or device. User-ID is a core Palo Alto Networks PAN-OS feature that continuously maps IP addresses to user identities (domain\username) and directory group memberships (domain\user_group), allowing security engineers to author granular security policies based on corporate roles rather than ephemeral network addresses.

---

User-ID Mapping Sources and Protocols

PAN-OS leverages multiple identity telemetry sources to populate its internal User-to-IP mapping table. Depending on enterprise architecture, network engineers can deploy one or a combination of the following mapping mechanisms:

Active Directory Domain Controller Security Event Logs

The primary identity source in traditional Microsoft environments is Active Directory (AD). When a user logs into a domain-joined workstation, the Domain Controller (DC) records Windows Security Event Logs. User-ID monitors these specific event IDs:

• Event ID 4624 (Successful Logon): Generated when a user successfully logs on to a computer. Provides the explicit IP address, domain name, and username.
• Event ID 4768 (Kerberos TGT Request): Generated when a Kerberos Authentication Service (AS) ticket (Ticket-Granting Ticket) is requested.
• Event ID 4769 (Kerberos Service Ticket Request): Generated when a user requests a ticket to access a specific network service.
• Event ID 4672 (Special Privileges Assigned): Captures administrative logons.

Syslog Listeners

For non-Windows devices, guest networks, Network Access Control (NAC) environments, and wireless networks, PAN-OS can act as a Syslog listener. Third-party systems—such as Cisco ISE, Aruba ClearPass, wireless LAN controllers (WLCs), VPN concentrators, and web proxy servers—send Syslog messages containing authentication events to the firewall. PAN-OS utilizes regular expression (regex) profiles to extract the IP address and username from incoming Syslog payloads and insert them into the User-ID database.

Microsoft Exchange Server Monitoring

In environments where mobile devices or unmanaged endpoints access email via Microsoft Exchange, User-ID monitors Exchange Server event logs (such as ActiveSync logon events). When an iPhone or Android device connects to Exchange to fetch email, User-ID extracts the client IP address and authenticated user credentials, establishing a User-to-IP mapping for the mobile endpoint without requiring a domain logon script or local agent.

Terminal Services (TS) Agent

In multi-user environments—such as Microsoft Remote Desktop Services (RDS), Citrix XenApp, or Terminal Services—dozens or hundreds of distinct users share a single IP address. Standard IP-to-User mapping cannot differentiate between individual user sessions originating from the same host IP.

The Palo Alto Networks Terminal Services (TS) Agent solves this by installing directly on the terminal server operating system. The TS Agent intercepts outbound TCP/UDP traffic and allocates dedicated source port ranges (e.g., ports 20000–20199 for User A, ports 20200–20399 for User B) to each logged-in user session. The TS Agent notifies the firewall of these port allocations via an encrypted control connection. When traffic hits the firewall, PAN-OS inspects both the source IP and source port range to accurately identify the specific user, enabling per-user policy enforcement on shared VDI platforms.

XML API

The PAN-OS RESTful XML API enables custom identity integration. External systems—such as custom captive portals, third-party Identity-as-a-Service (IDaaS) platforms, or custom NAC solutions—can send HTTP POST requests directly to the firewall's XML API endpoint (/api/?type=user-id&action=set) to register or unregister IP-to-User mappings programmatically in real time.

---

Agentless User-ID vs. Standalone Windows User-ID Agent

Deploying User-ID in an Active Directory environment requires choosing between Agentless User-ID and the Standalone Windows User-ID Agent. Both mechanisms collect DC event logs and perform client probing, but their architecture and scaling profiles differ significantly.

Architectural Recommendations

• Agentless Deployment: Ideal for small-to-medium deployments with fewer than 10–20 Domain Controllers and low logon velocity. It simplifies operations by eliminating dedicated Windows server management.
• Windows User-ID Agent Deployment: Mandatory for large enterprises with dozens of Domain Controllers, high logon rates, or multi-firewall environments. Installing the User-ID Agent on a dedicated Windows Server offloads WMI/WinRM processing overhead from the firewall's Management Plane and allows a single agent to collect mappings once and push them to multiple firewalls across the enterprise.

---

Cloud Identity Engine (CIE)

As enterprise workloads migrate to cloud-native identity architectures, traditional On-Premises Active Directory and LDAP polling face severe limitations. Cloud-first organizations using Microsoft Entra ID (Azure AD), Okta, or Google Workspace lack local domain controllers for WMI log scraping and cannot expose LDAP servers over public networks safely.

The Cloud Identity Engine (CIE) is a Palo Alto Networks cloud-native service that acts as a secure identity broker between cloud identity providers (IdPs) and Palo Alto Networks security infrastructure (PAN-OS firewalls, Prisma Access, and Strata Cloud Manager).

Key CIE Features and Mechanism

• Cloud-Native Directory Synchronization: CIE connects directly to cloud IdPs using SCIM 2.0 (System for Cross-domain Identity Management), OAuth 2.0, and Microsoft Graph API. It continuously synchronizes users, groups, and directory attributes in real time without requiring inbound firewall rules or local directory agents.
• Zero On-Premises Infrastructure: Eliminates the need to maintain domain-joined User-ID Agents, LDAP proxy servers, or site-to-site IPsec tunnels purely for identity synchronization.
• Unified Identity Source: Consolidates multiple identity providers (e.g., an enterprise using Entra ID for corporate staff and Okta for contractors) into a single, standardized identity source accessible by all firewalls across the global fleet.
• SAML 2.0 Authentication Integration: CIE streamlines authentication profiles for GlobalProtect and Captive Portal by managing SAML IdP metadata, certificate rotation, and single sign-on (SSO) redirect workflows central in the cloud.

---

User-to-IP Mapping Table Operations and Security Policy Enforcement

Mapping Table Lifecycle and Priority

PAN-OS maintains a unified User-to-IP mapping table in memory. When multiple identity sources report mapping data for the same IP address, PAN-OS resolves conflicts using a strict mapping source priority:

1. Terminal Services (TS) Agent (Highest priority, matching IP + source port range)
2. XML API / Captive Portal (Explicit user authentication/registration)
3. GlobalProtect Client Authentication (Direct remote access tunnel logon)
4. User-ID Agent / Agentless AD DC Logs (Domain logon events)
5. Syslog Listener / Client Probing (Secondary passive telemetry)

Each mapping entry carries a configurable timeout (default initial timeout is 45 minutes). When a user logs in, the mapping timer starts. Subsequent identity events or active client probing (WMI/NetBIOS) refresh the timer. If no renewal occurs before the timeout expires, PAN-OS purges the mapping entry to prevent unauthorized access if an IP is reassigned via DHCP.

Security Policy Enforcement

Once User-ID populates the mapping table, security engineers construct Security Policy rules utilizing identity objects:

• User Objects: Rules targeting specific users (corp\\j.doe).
• Group Objects: Rules targeting Active Directory or CIE groups (corp\\finance-dept, corp\\domain-admins). Group membership is resolved periodically via LDAP or CIE group queries.
• Dynamic User Groups (DUG): Advanced policy objects that dynamically aggregate users based on automated tags (e.g., tagging a user as high-risk-user via Cortex XSOAR or API when malicious activity is detected). Security policies referencing the DUG automatically enforce restricted access without committing configuration changes.