PCNSE · Question #403
An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama. The enterprise already uses GlobalProtect with…
The correct answer is C. Assign a master device in Panorama through which Prisma Access learns groups. Step 3: Allow Panorama to use group mappings in security policies by configuring one or more next-generation on-premises or VM-series firewalls as a Master Device. If you don’t configure a Master Device with a Prisma Access User-ID deployment, use long-form distributed name…
Question
An enterprise has a large Palo Alto Networks footprint that includes onsite firewalls and Prisma Access for mobile users, which is managed by Panorama. The enterprise already uses GlobalProtect with SAML authentication to obtain IP-to-user mapping information. However, Information Security wants to use this information in Prisma Access for policy enforcement based on group mapping. Information Security uses on-premises Active Directory (AD) but is uncertain about what is needed for Prisma Access to learn groups from AD. How can policies based on group mapping be learned and enforced in Prisma Access?
Options
- AConfigure Prisma Access to learn group mapping via SAML assertion.
- BSet up group mapping redistribution between an onsite Palo Alto Networks firewall and Prisma
- CAssign a master device in Panorama through which Prisma Access learns groups.
- DCreate a group mapping configuration that references an LDAP profile that points to on-premises
How the community answered
(27 responses)- A4% (1)
- B11% (3)
- C81% (22)
- D4% (1)
Explanation
Step 3: Allow Panorama to use group mappings in security policies by configuring one or more next-generation on-premises or VM-series firewalls as a Master Device. If you don’t configure a Master Device with a Prisma Access User-ID deployment, use long-form distributed name (DN) entries instead. https://docs.paloaltonetworks.com/prisma/prisma-access/prisma-access-panorama- admin/configure-user-based-policies-with-prisma-access/configure-user-id-in-prisma-access.html
Topics
Community Discussion
No community discussion yet for this question.