Portnox Firewall Identity Mapper

Ending the IP Guessing Game: The Portnox Firewall Identity Mapper

When a security alert triggers at 2:00 AM for IP address 10.1.45.112, a SOC analyst faces an immediate hurdle: firewalls log numbers, not people. Determining whether that IP belongs to a compromised server, a guest smartphone, or the CFO requires manually cross-referencing DHCP leases, RADIUS accounting, and VPN session logs. This tedious translation process burns through the most critical minutes of incident response.

Furthermore, IP-based policies are inherently fragile. Because addresses reassign dynamically whenever a user reconnects to Wi-Fi or establishes a VPN tunnel, enforcing security by static IP subnets creates operational friction. Security teams naturally think in terms of roles and departments—not ephemeral IP addresses.

Bridging the Gap with Identity-Aware Firewalls

The new Portnox Firewall Identity Mapper resolves this disconnect, launching initially with native integration for Palo Alto Networks.

Because Portnox Cloud already manages your NAC and RADIUS authentications, it inherently knows which authenticated user is tied to which IP address in real-time. The Identity Mapper operates as a lightweight Docker container deployed on a host that can reach your Palo Alto management interface. It continuously extracts these user-to-IP mappings from Portnox and pushes them directly into the firewall’s User-ID engine via its XML API.

Transforming Network Policy

This integration fundamentally changes how access rules are written and maintained. Instead of juggling fragile IP address objects, administrators can write literal, role-based rules—such as “Engineering can reach GitHub.”

As employees join the company, switch departments, or offboard, the firewall’s enforcement automatically aligns with their new IdP group status. No manual rule edits are required. Most importantly, during a late-night investigation, the threat log immediately displays the user’s identity, eliminating forensic guesswork.

Deployment and Architectural Specifications

The Identity Mapper is engineered for security and simplicity:

• Outbound-Only Communication: The Docker container communicates exclusively outbound to Portnox Cloud and your firewall’s management interface. It requires zero inbound ports, ensuring your firewall management remains entirely isolated from the public internet.
• Least-Privilege Configuration: Deployment is highly focused. Portnox Cloud automatically generates a pre-filled Docker run command containing your specific instance details. On the firewall, administrators only need to create a restricted admin role scoped exclusively to the User-ID XML API.
• Highly Scalable: A single container deployment can simultaneously manage and synchronize identity mappings across multiple Palo Alto firewalls.

While Palo Alto is the inaugural supported vendor, additional firewall integrations are slated for future release. The Portnox Firewall Identity Mapper is available immediately for organizations running Palo Alto firewalls alongside Portnox NAC or ZTNA—ensuring that the next time a late-night alert fires, the analyst already knows exactly who is on the network.