PCNSE · Question #274
Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?
The correct answer is A. syslog listening. When users authenticate through a web proxy (such as a Squid or Blue Coat proxy), the proxy already knows the username-to-IP mapping. The proxy typically outputs this information via syslog messages. The PAN-OS User-ID agent (or the firewall itself) can be configured as a syslog
Question
Which User-ID method maps IP addresses to usernames for users connecting through a web proxy that has already authenticated the user?
Options
- Asyslog listening
- Bserver monitoring
- Cclient probing
- Dport mapping
How the community answered
(51 responses)- A94% (48)
- B4% (2)
- D2% (1)
Explanation
When users authenticate through a web proxy (such as a Squid or Blue Coat proxy), the proxy already knows the username-to-IP mapping. The proxy typically outputs this information via syslog messages. The PAN-OS User-ID agent (or the firewall itself) can be configured as a syslog listener to parse these proxy-generated syslog messages and extract the IP-to-username mappings. Server monitoring probes Active Directory or other directory servers for login events, client probing actively queries endpoints, and port mapping is used for terminal server environments - none of these are applicable when the authentication has already been handled by a web proxy.
Topics
Community Discussion
No community discussion yet for this question.