topic Re: GlobalProtect logged in user issue in GlobalProtect Discussions

GlobalProtect logged in user issue

MRamadanAHafiez — Sat, 09 Oct 2021 19:52:43 GMT

Hello Mr.

After changing from GlobalProtect 5.1.14 to 5.2.8 it's very noticed that added authentication user such as mydomain\myusername just change it self to myusername only just by itself which doesn't allow it to access the resources.

Why that? Any ideas?

Re: GlobalProtect logged in user issue

MRamadanAHafiez — Tue, 12 Oct 2021 14:36:42 GMT

Hellooo, No Ideas so far ?!

Re: GlobalProtect logged in user issue

TomYoung — Wed, 13 Oct 2021 01:29:57 GMT

Hello @MRamadanAHafiez ,

Most likely the format of the username does not match. Do you have a username or group in the security policy rule that allows access to your resources? You can verify the format of the username via the monitor tab, but I prefer CLI.

Use "show user ip-user-mapping all" to verify active username format.

Use "show user group name [group]" to verify username format needed to match group.

This doc will have the fix most of the time -> https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/user-id-features/support-for-multiple-username-formats.

Thanks,

Tom

Re: GlobalProtect logged in user issue

MRamadanAHafiez — Wed, 13 Oct 2021 06:16:55 GMT

Hello @TomYoung

Thank you for your reply.

I will check the link you've provided.

Firstly , yes I have policies based on users and groups that we are talking about.

Secondly, I have checked traffic logs and when the user-id field is mydomain\username then I know everything will be as expected but whenever it comes username only I know it won't work as expected.

Adding: a Cisco Duo is must to have client connected by GlobalProtect.

I will check the link it might help.

Re: GlobalProtect logged in user issue

MRamadanAHafiez — Thu, 14 Oct 2021 11:12:50 GMT

Hello,

So far and after checking many times it seems this issue occures due to GlobalProtect client fail-over the windows account and it was allowed to use windows SSO "YES" now we set it to "NO" and waiting the final result.