portnox/fw-id-mapper repository overview

⁠Portnox Firewall Identity Mapper

The fw-id-mapper container sends Portnox Cloud’s user-to-IP mapping data to an on-premises firewall, so the firewall can apply policies and write logs based on the user instead of just the IP address. When a user’s IP address changes, for example through Wi-Fi roaming, a VPN connection, or a new DHCP lease, the container reports the change to the firewall so its identity data stays current.

The container supports Palo Alto Networks, Fortinet FortiGate, and Check Point firewalls.

The container makes outbound connections only, to Portnox Cloud and to the firewall. It needs no inbound ports, and the firewall does not need to be reachable from the Internet.

⁠Deploy

The command below is an example, with placeholder values that won’t work as-is. We recommend getting the actual command from Portnox Cloud instead of creating one manually. In Portnox Cloud, go to Settings > Integration Services > Firewall Integration Service and click on the Add Docker container button. Portnox Cloud generates the complete command for you, already filled in with your organization ID, instance ID, and API key.

docker run -d \
  --name portnox-fw-id-mapper --restart=on-failure --pull always \
  -e OrgId=<org_id> \
  -e InstanceId=<instance_id> \
  -e ApiKey=<api_key> \
  portnox/fw-id-mapper:latest

On the firewall side, prepare the integration for your vendor:

• Palo Alto Networks: Enable User-ID and its XML API, and create a dedicated administrator account for the integration.

• Fortinet FortiGate: Enable RADIUS accounting on an interface and create a RADIUS Single Sign-On (RSSO) agent.

• Check Point: Enable Identity Awareness with the Identity Web API, and add the Docker host as an authorized client.

You configure the firewall connection details (such as the address, port, and key or shared secret) in Portnox Cloud, not in this command. The container fetches them from Portnox Cloud once it’s running.

⁠Configuration

You configure the container using environment variables or a configuration file. Additional variables control things like sync intervals, retry behavior, and custom TLS certificates for firewalls that use a private certificate authority. For the complete list of variables, see the full documentation.

⁠Updating

Update the container by redeploying it manually, or automate updates with the portnox-autoupdate container⁠.

⁠Full documentation

For full documentation, see the following topic: docs.portnox.com⁠.