Parsing credentials from anyconnect through the network.

[Heino Human]

Hi Legends, 

I'm a bit stumped and trying to find a solution on parsing credentials when users authenticate via VPN/ISE and then trying to access data centre services. 

Our setup is as follows

1. VPN USER > AnyConnect > FTD at the internet edge
2. Once user is authenticated and authorised, they can access internal network services
3. For services behind our Palo Alto Data Centre Firewall, the VPN user requires to parse their authentication details to access services. Without the username, they cannot access any services. Before the Firepower internet edge firewall, this was possible by using Palo Alto internet edge firewall. We replaced this a month ago and I have setup the VPN, though users can’t access DC services.

We do not want to change this because if we get a ‘man in the middle’ attack, they can replicate the VPN IP Pool and access DC services without a username associated.

Do you guys have any idea how we can get VPN users keep their domain/username when traversing the network. Is it possible for ISE to forward these to the PANs?

Any thoughts/ideas will be greatly appreciated. 

[Marvin Rhoads · Accepted solution]

ISE can pass the username-IP mapping to PANW firewalls via syslog. You then need to allow the USER-ID syslog Listener-UDP service into PANW mgmt interface (or Panorama if you are using that) and setup a parser to extract the information for use in your PANW identity policy.

See this article for example:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5sCAC

[Heino Human]

Thank you Marvin, very helpful as always.

I have not been able to test it, but from what i have read, it should work perfectly.

The only thing is now, the business has decided to go down Azure AD & MFA.... :) Now my next challenge begins!