Policy rules based on users and groups?

防火墙管理员基于用户和组定义策略规则之前，必须进行哪些配置？

Certificate-based authentication for both users and devices using an On-premises Microsoft Active Directory Certificate Services (AD CS) hierarchy As the primary certificate authority (CA). The enterprise also requires Online Certificate Status Protocol (OCSP) checks to ensure efficient revocation status Updates and reduce the overhead on its NG Ws. The environment includes multiple Active Directory forests, Panorama management for several geographically Dispersed firewalls, GlobalProtect portals and gateways needing distinct Certificate profiles for users and devices and strict Security policies Demanding frequent revocation checks with minimal latency.

Which approach best addresses these requirements while maintaining

Consistent policy enforcement?

一家大型企业希望使用本地 Microsoft Active Directory 证书服务 (AD CS) 层次结构作为主要证书颁发机构 (CA)，为用户和设备实施基于证书的身份验证。该企业还需要在线证书状态协议 (OCSP) 检查，以确保高效的吊销状态更新并降低其下一代防火墙的开销。该环境包含多个 Active Directory 林、用于多个地理位置分散的防火墙的 Panorama 管理、GlobalProtect 门户和网关，这些门户和网关需要为用户和设备提供不同的证书配置文件，并且严格的安全策略要求频繁进行吊销检查并最大程度地降低延迟。