How to Add Groups or Users to Security Policy

155137

Created On 09/25/18 19:24 PM - Last Modified 01/08/25 11:28 AM

Group Mapping

Security Policy

Policy

User-ID

8.1

8.0

7.1

9.0

PAN-OS

Environment

Configure LDAP sever profile on the device.
To configure Group Mapping on the device. Go to Device > User Identification > Group Mapping Settings
1. Click Add at the bottom.
2. Select the LDAP Server Profile
3. Optional Add User Domain (NETBIOS Domain Name) from Windows AD.
4. Then go to Group Include List Tab and Under Available Group either Search or Browse to the security group, highlight and click plus sign to add the group (recommended to add group include list in a large AD environment due to idmgr limit).
Verify the device can pull the group information by running the command:
```
> show user group list
```
which populates all the groups the device is pulling from the AD server.
Go to Policies > Security.
Click Add for a new policy or click an existing policy to add the groups.
Under the Policy > User > Source User, click Add. The drop down populates available groups.
Configure the security policy with the groups to be restricted.

User-added image

Additionally security policies can be configured with users to be restricted. You need to manually type the username of the user, and the user will auto populate. Drop down will not populate Users, as it only auto populates User Groups.