Michael Lorincz — Technical Notes

PAN - User-IDs

3 min read

paloalto userid

https://sutterhealth.sharepoint.com/sites/NetworkBuildandEngineering/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FNetworkBuildandEngineering%2FShared%20Documents%2FGeneral%2FNetwork%20Security%20Engineering%2FSolutions%2FPalo%20Alto%20User%2DID

per Scott We currently have the Palo Alto user-id agent running on 5 Windows servers so that the firewalls can get user to IP mappings from AD logs.

Currently there are 5 servers running the agent - 2 prod, 2 QA and 1 Dev.

GuestNameServerNamePurposeIPPanorama Use
DCQWAPP0566dcqwapp0566.root.sutterqa.orguser-id agent10.156.102.157Dev Panorama - TPL-DEV-INTGW-Net-fw40
Device > Data Redistribution > Agents
DCPWAPP2612dcpwapp2612.root.sutterhealth.orguser-id agent10.155.102.158Prod Paanorama- TPL-IntGateways
Device > Data Redistribution > Agents
RDPWAPP0439rdpwapp0439.root.sutterhealth.orguser-id agent10.234.9.41Prod  Panorama – TPL-IntGateways
Device > Data Redistribution > Agents
RDDWAPP019rddwapp019.root.sutterdev.orguser-id agent10.233.16.219Not in Use
RDQWAPP0747rdqwapp0747.root.sutterqa.orguser-id agent10.233.17.79Not in Use

Since we are responsible for managing the Palo user-id agent running on the servers above, you will need to have server admin access.

The following are steps required in getting access to the servers as well as accessing the servers in dev and qa.

  1. Send an email to your supervisor/manager, requesting SA access to these servers.

  2. Once the supervisor/manager replies back with their approval, open a request in ServiceNow by following this link: Add or Delete an account and filling out the form as Follows

  3. Fill out the form with your details for Requested for, Call back number, and best time to contact.

  4. Request Type: Add/Reactivate Account

  5. Nature of Account: Individual

  6. Account Type: Server Admin (SA) – Tier 1

  7. Click the upload link to upload you manager’s approval

  8. Under Select the Servers: Add the servers above: by entering the name in the field and selecting the server

  1. Add Request Title: SA access request for Prod, QA and Dev servers

  2. Watch list – add anyone else (other than the requester) that you would like to have updates sent to

  3. Additional Requirements: Add that the QA and the Dev servers are not in the prod domain so you will also need SA accounts in the Dev and QA domains.

  4. Once access is granted you should see 3 SA accounts when you log into the CyberArk portal (one for each domain).

If you are not seeing the new accounts, please open the filters in cyberark and select all accounts

  1. To initiate an RDP session to a Dev or QA server, you will need to use the appropriate dns suffix and account for the domain the server is in.

  2.  QA Server:

                                                    i.     If connecting by name — DCQWAPP0566.root.sutterqa.org

                                                   ii.     Login – sutterqa\QA SA Account – sutterqa\daviss2sa

  1. Dev Server:

                                                    i.     If connecting by name — RDDWAPP019.root.sutterdev.org

                                                   ii.     Login – sutterdev\Dev SA Account – sutterdev\daviss2sa

Example

Let me know if there are any steps that I missed or if any of the steps are in need of updating.

This is also now documented in our SharePoint site -  ​docx icon Server Access To Manage PaloAlto User-ID Agents.docx

Graph View

Backlinks