How to Install and Configure PanAgent for Active Directory

How to Install and Configure PanAgent for Active Directory
One of the unique attributes of the Palo Alto Networks firewall is the ability to control traffic
based upon usernames and group names. In PANOS 4.0, there are three different server-based
agents that are used to track users:

PanAgent
o User identification for Active Directory
o Agent polls the domain controllers to determine who is logged into what IP, and
sends that information to the PA firewalls
o Discussed in this document

LDAPAgent
o User identification for LDAP servers, such as eDirectory
o Discussed in this knowledge base document:
https://live.paloaltonetworks.com/docs/DOC-1445

TSAgent
o User identification on Terminal Servers/Citrix Servers
o The agent is installed on each terminal server, and sends the username/IP
information to the PA firewalls
o Installation steps are in the PANOS 4.0 Administrators Guide, found on our
support site
For a technical overview of each of these agents, please read the “User Identification Tech Note
– PANOS 4.0” found at https://live.paloaltonetworks.com/docs/DOC-1807.
This document will give the steps to install and configure the PanAgent for Active Directory,
which from now on will be referred to as the PanAgent.
PANOS 4.0
1
To determine beforehand:

Determine onto which machine the PanAgent will be installed. That machine must:
o be running Windows XP service pack 2 or higher, or Windows Server 2003
service pack 2 or higher, or Windows Server 2008
o be a member of the domain to be monitored
o have network connectivity to the DCs and to the management port of the PAN
firewall
o should be near the DCs that it will be querying, as it will be polling the DCs very
frequently

Determine which user account will be used by the PanAgent to query the domain. You
can either use a Domain Administrator account, or set up a more restrictive account as
described in Appendix A of this document.

Determine which domain (with corresponding domain controllers) that the PanAgent will
be querying. Note that you need one PanAgent service for each domain. One PanAgent
can handle a maximum of 64,000 users in a domain, and can talk with up to 100 DCs.
PANOS 4.0
2
Part 1: Installing and Configuring the PanAgent
1. Login to the Windows machine that you will use to run the PanAgent. Login as a user
with administrator privileges on that machine.
2. Download the latest version of the User Identification Agent for AD (PanAgent.msi)
from https://support.paloaltonetworks.com. Select the version that ends with “-AD”.
3. Install that file, accepting the all the defaults. This installs the software as a service on the
Windows machine.
4. The next step is to edit that service using the services.msc administrative tool. Start the
tool, and look for your new service in the list.
PANOS 4.0
3
5. Edit the PanAgentService. You will see this screen:
On the Log On tab, specify the username and password of an account that has the ability
to read the domain controller security logs. Refer to Appendix A on page 15 for the steps
to create such an account.
Click “Apply”, and you will see the following pop-up:
PANOS 4.0
4
6. In order for the service to run as that user, you must start or restart that service. Use the
General tab to do that now.
7. Close the Services control panel.
8. Start the PanAgent configuration program (Start -> Programs -> Palo Alto Networks > User Identification Agent). In the top-right corner, click Configure.
9. On the configuration screen, fill in the following fields:

Domain name- enter the FQDN of the domain (example: acme.com). Do not use
the NetBIOS name.

Port number of your choosing- can be any port number that is not currently used
on this machine. Make sure the local machine does not have a Windows firewall
that is blocking inbound connections on that port.

Domain controllers IP addresses - You should add in ALL the DCs in the
domain here, since users can be authenticated with any DC in the domain. You
can enter up to 10 IP addresses by default, up to 100 if you make a configuration
change.1
Note: the IP at the top of this list is the one and only DC that will be queried for
user and group membership.

Allow list- list of subnets that contain users you want to track.

Ignore list- specific IP addresses that fall into the Allow List range that you do
not want to track. For example, you should enter here the IPs of your Terminal
Servers. (Note that if you want to track users on a Terminal Server, you must
install the PAN Terminal Services Agent on each Terminal Server.)
1
To allow the agent to talk to up to 100 DCs, edit the config.xml file found in the install directory of the agent. Stop
the agent service, change the file to say <max-dc>100</max-dc>, and start the agent service.
PANOS 4.0
5
Here is an example:
In the bottom left corner of that same window, there are various timer values that you
may want to adjust after the PanAgent is operational. For now, accept the default values.
Once you are finished, click OK.
10. On the main screen, click on Get LDAP tree button. The PanAgent service will query
the first DC in the list, and retrieve a list of all of the groups in the domain. This will take
a few minutes if the domain is large. Once the groups are retrieved, information will
appear:
PANOS 4.0
6
11. It is best practice to filter which AD groups will be tracked and forwarded to the PA
firewall. You can configure this using the Filter Group Members and Ignore Groups
buttons are in the top right-corner of the main screen. You will want to configure one or
the other, but probably not both.

Use Filter Group Members if you have a large number of groups in the domain,
and you want to specify exactly which groups the PanAgent will look for in the
domain security logs.

Use Ignore Groups if you want the PanAgent to pay attention to all of the AD
groups, but ignore a handful of those groups.
Click on Filter Group Members, and the screen below appears. Select the AD groups
you want to control using the PAN firewall.
Only the groups in the right-hand column will appear in the policy configuration screen
on the PAN firewall, as shown here:
PANOS 4.0
7
Best practice: you should include “domain users” in the list of filtered groups, since the
PAN Agent only keeps track of users that are members of the groups listed on the Filter
Groups page.
12. You can monitor the agent status window in the top left corner of the GUI.
Possible status codes:
 Connection Failed
 Please start the PanAgent service first
 Reading domainname\enterprise admins Membership
 No errors
13. Click on Get Groups, and a list of domain groups will appear in the pull-down list.
If you select a particular group from that pull-down list, the users who are a member of
that group are retrieved and displayed in the text box beneath.
PANOS 4.0
8
14. After the agent has read all the security groups, it will read through the 50,000 most
recent log entries in each Domain Controller’s security log, searching for login events2.
(Again, this may take a while.) The PanAgent will create list of usernames and associated
IPs. Click on Get All to see the IP to username mappings.
15. If you have a particular IP address in mind, and want to find out which user maps to that
IP, you can enter that IP to the left of the Get IP Information button. Click that button,
and the name associated with that IP will appear.
16. To confirm that the server running the PanAgent is listening on the port you configured
in a previous step, use the following command on the Windows machine:
netstat –an | find “xxxx”
where xxxx is the port number you configured earlier. Here is example output, showing
that the UserID agent is in fact listening on port 9999:
2
Event IDs on Windows 2000 & 2003: 672,673,674. Event IDs on Windows Server 2008: 4624,4768,4769,4770.
PANOS 4.0
9
Part 2: Configuring the firewall to communicate with the PanAgent
17. Login to the Palo Alto Networks firewall as an administrator. Go to Device tab -> User
Identification.
18. Under the section titled “User Identification”, Add the IP address and port of the
PanAgent that you just configured. Here is an example:
19. You must also enable user identification on each zone that you want to monitor. On the
Network tab -> Zones page, edit the appropriate zone. In the bottom left corner of the
zone properties page, check the box to Enable User Identification.
20. The firewall is now configured to talk to the PanAgent. Commit your changes at this
time.
PANOS 4.0
10
21. To confirm everything is configured properly, bring up a CLI to the firewall, and execute
this command:
show user pan-agent statistics
Things are working properly if you get output similar to below:
If you see the message “No pan-agent configured”, make sure you have committed your
configuration.
22. Now view the list of usernames and IPs that the firewall has received from the PanAgent,
using this command:
show user ip-user-mapping
If there is a long list of users, and you want to determine if a particular user (example:
jpage) is in the list, use this command:
show user ip-user-mapping | match jpage
Or you can search the output for a particular source IP:
show user ip-user-mapping | match 10.1.2.3
PANOS 4.0
11
23. You can view the defined AD usernames and associated groups using:
show user pan-agent user-IDs
In this example, the AD groups are being filtered to only keep track of the “domain
users” group.
PANOS 4.0
12
Part 3: Testing
24. At this point, you can test by logging into the domain as a regular user on machine in the
IP address range you specified to be monitored by the agent. After a few minutes,
usernames will appear in the traffic logs (Monitor tab -> Logs -> Traffic) as well as in
the ACC drill-downs of particular applications.
25. On the firewall, go to the Policies tab-> Security screen, and select one of the policies.
Edit the value in the Source User column. In the window that appears, you will see a
listing of Active Directory Groups—these were pulled from the domain. Recall that if
you filtered the groups, only the groups you specified will appear here.
Part 4: Troubleshooting Hints
26. If the firewall is not successfully communicating with the PanAgent, make sure that the
port you specified is open on the intermediate network. You can test this by telneting
from the firewall to the Windows machine:
If there is a reply from the Windows machine (as shown above), you know that there isn’t
another device blocking the communication.
27. For testing purposes, you can clear the logged-in user database on the PAN firewall,
either for a single-IP, or the complete database:
clear user-cache ip 1.1.1.9
clear user-cache all
PANOS 4.0
13
28. Ignoring Service Accounts
Some customers have batch files that execute after a user logs in, and these batch files
run as a different AD account. That service account may appear in the PanAgent user
database. If that is the case, you can tell the PanAgent to ignore that particular user
account. To do this, create a file called “ignore_user_list.txt” in the directory in which the
PanAgent was installed (typically c:\Program Files\Palo Alto Networks\PanAgent). Insert
into that file the domainname\username of the service account that you want the
PanAgent to ignore. Note that the username is case sensitive.
29. The PanAgent maintains a log file which is very useful for troubleshooting. The log file
can be viewed using File -> Show Logs.
To enable detailed information on the PanAgent operation, go to File -> Debug and
select Verbose. The logs will now display more detailed messages.
PANOS 4.0
14
Appendix A
Creating a Domain Account for use with PanAgent Service
The PanAgent must have the ability to read the security log on the domain controllers. In
particular, the user right “Manage auditing and security log” must be given to that account.
The Domain Admins group has that user right by default. If you want to create an account
that has more restrictive access than Domain Admins, follow these steps.
Part 1: Creating the New Account, and Assigning the User Right
1. Login to a domain controller as an administrator. Start Active Directory Users and
Computers. In an OU that is appropriate, create a new account. You can give it any name
you’d like.
Assign a password to the account, and uncheck the box user must change password at
next logon.
PANOS 4.0
15
2. Now Edit the Default Domain Controller Security Policy, found under Programs ->
Admin Tools. Drill down to Security Settings -> Local Policies -> User Rights
Assignment. You will see the screen below.
3. In the right-hand pane, locate the user right “Manage auditing and security log”. Doubleclick that entry. You will see that only Administrators have that user right.
PANOS 4.0
16
4. Click Add User or Group.
5. Click Browse.
6. Enter the username of the account you just created, and click on Check Names to confirm
that account exists. The account name will become underlined.
7. Click Ok two times. The user right will now look like this:
8. Close that screen, as well as exit from the Default Domain Controller Security Policy
tool.
PANOS 4.0
17
9. In order for this policy to take effect immediately, run this command on each domain
controller in the domain:
If you do not run this command on each DC, it will take up to 60 minutes for this change
to be propagated onto each DC.
Part 2: Assigning Permissions on PanAgent Installation Directory
You must edit the permissions on the installation directory for the PAN Agent and give
the new account full control. Note that if you do not change the permissions, the new pan
agent account will not be able to create the troubleshooting log in this directory.
10. Use Windows Explorer to drill down to C:\Program Files\Palo Alto Networks\PanAgent.
Right-click the directory name PanAgent, and select Properties.
PANOS 4.0
18
11. In the PanAgent Properties window, select the Security tab, and click on the Advanced
button. The window will be similar to the following:
12. Click Add, and enter the name of the new account. Click Check Names to confirm that
you spelled the account name correctly.
PANOS 4.0
19
13. Click Ok, and the following screen will appear.
14. In the Permission Entry for PanAgent window, check the box to Allow Full Control. All
the boxes below it will become checked. Click Ok. The Advanced Security Settings for
PanAgent window will now have a new entry at the top of the list:
15. Click Ok twice to close all permissions windows.
PANOS 4.0
20
Part 3: Testing the New Account
16. To perform an initial test, logout of the DC, and log back into the DC as the new user
(PanUserID).
17. While logged in as the new user, start event viewer (hint: from a command prompt, you
can type eventvwr.msc.)
18. Confirm that the new user can view the events in the security log.
19. Use View -> Find to search for login events (event ID 672 on Windows 2000/2003,
event ID 4624 on Windows 2008). You should see numerous events of that type.
PANOS 4.0
21
20. (OPTIONAL) If you want to further restrict this account from being able to clear the
security log, refer to Microsoft KB 323076.
PANOS 4.0
22
Part 4: Configuring the PAN Agent Service to Use the New Account
21. At this point, you can login to the server that is running the PAN PanAgent, and
configure the PanAgent service to use the newly-created account.
22. Restart the service so that it will use the new account.
23. Confirm that you can view the troubleshooting log by starting the PanAgent GUI, and
going to File -> Show Logs.
If the log file does not exist, make sure you completed the steps in part 2 of this appendix.
PANOS 4.0
23