Palo Alto PAN-OS User-ID from DHCP with MAC/hostname
At one point I’ve started looking for a way of being able to filter source traffic based on host’s MAC address or its hostname. By having DHCP configured locally on Palo Alto for a specific vlan, I’ve found a solution described below (source: https://jamesholland.me.uk/user-id-from-dhcp).
This is for when there is no usable method to map users to IP addresses, or when you want something simple for your home or non-production network. MAC addresses and hostnames can be useful identifiers, which persist across IP address changes. For this method to work, the PAN-OS device needs to be the DHCP server, as it forwards the DHCP logs back to its management interface, and parses out the MAC address/hostname to be used as the “user” in the User-ID table. A user wanted to use the idea of presenting MAC addresses or hostnames as User-ID mappings in a non-production environment, and the CLI commands I gave them seemed useful to share.
Note: There is a skillet for this (https://github.com/scotchoaf/UserIDskillet), but the user didn’t want to stand-up something to run Panhandler, and just wanted the CLI configuration commands.
Use your own values for <zone-name> (the zone facing the devices/users, as you’ll need User-ID enabled on this zone), and <firewall-mgmt-ip> (the PAN-OS device’s management IP address):
set zone <zone-name> enable-user-identification yes
set user-id-collector setting enable-mapping-timeout no
set deviceconfig system service disable-userid-syslog-listener-udp no
set shared log-settings syslog mgmt-interface server mgmt-intf transport UDP port 514 format BSD facility LOG_USER server <mgmt-ip>
set shared log-settings system match-list dhcp-log-match filter "(eventid eq lease-start)"
set user-id-collector syslog-parse-profile paloalto-dhcp regex-identifier event-regex "DHCP\ lease\ started"
set user-id-collector syslog-parse-profile paloalto-dhcp regex-identifier username-regex "hostname ([a-zA-Z0-9\_\[\]\-]+)"
set user-id-collector syslog-parse-profile paloalto-dhcp regex-identifier address-regex "ip ([A-F0-9a-f:.]+)"
set user-id-collector server-monitor mgmt-interface syslog syslog-parse-profile paloalto-dhcp event-type login
set user-id-collector server-monitor mgmt-interface syslog address <firewall-mgmt-ip> connection-type udp
In the list of commands above, the line:
set user-id-collector syslog-parse-profile paloalto-dhcp regex-identifier username-regex "hostname ([a-zA-Z0-9\_\[\]\-]+)"
could also be replaced with:
set user-id-collector syslog-parse-profile paloalto-dhcp regex-identifier username-regex "mac ([a-fA-F0-9:]+)"
or:
set user-id-collector syslog-parse-profile paloalto-dhcp regex-identifier username-regex "mac ([a-zA-Z0-9:\ \-]+)"
The first option pulls the DHCP registered hostname to be used in User-ID, but note that some devices will not supply one, leading to empty values.
The second option pulls just the MAC address.
The third option crudely pulls the MAC address *and* the hostname e.g. aa:bb:cc:dd:11:22 – hostname google-home-mini, and this is what the customer used, as the combination of both was the most useful to them.
Firewall MAC Palo Alto PanOS security User-ID