An administrator needs to build Security rules in a Device Group that allow traffic to specific users and groups defined in Active Directory. What…

To create Security policies in Panorama that reference Active Directory groups, Panorama must first be aware of those groups. Panorama itself does not directly query the directory server. Instead, you must designate a managed firewall as the "master device" for the device group. This master device is configured with Group Mapping settings to connect to the LDAP server (Active Directory). It retrieves the list of available groups and provides this list to Panorama. Panorama then uses this information to populate the user/group fields in the policy editor, allowing the administrator to build the rules.

A: A certificate profile is used to secure the LDAP connection (LDAPS) but is not the primary mechanism required for Panorama to obtain the list of groups for policy creation.

B: Group Mapping must be configured on the designated master device for the device group, not just any arbitrary firewall. The rules are created in the device group context.

C: User-ID Redistribution is for sharing learned IP-address-to-user mappings between firewalls and Panorama, not for retrieving the list of available directory groups for policy configuration.

1. Palo Alto Networks Panorama™ Administrator's Guide 10.2

Chapter: Centralized Logging and Reporting

Section: Configure a Master Device and Configure Group Mapping. "To use group-based policies

you must configure a Master Device for each device group that will use group-based policies. Panorama uses the master device to retrieve the list of groups from the LDAP server you specify in a group mapping configuration."

2. Palo Alto Networks User-ID™ Administrator's Guide 10.2

Chapter: Map Users to Groups

Section: Configure Group Mapping. This section details the process of configuring a firewall to connect to an LDAP directory to retrieve group information

which is the function performed by the master device on behalf of Panorama.

3. Palo Alto Networks Panorama™ Administrator's Guide 10.2

Chapter: Manage Firewalls

Section: User-ID Redistribution. "User-ID redistribution enables you to scale a User-ID deployment by allowing you to share user mapping information from one Palo Alto Networks firewall or Panorama to another." This confirms redistribution is for IP-user mappings

not group lists for policy creation.