topic Re: pre-logon - not seeing "pre-logon" user in traffic logs / 0 hits on pre-logon policy rules in GlobalProtect Discussions

pre-logon - not seeing "pre-logon" user in traffic logs / 0 hits on pre-logon policy rules

jgardner150 — Thu, 16 Dec 2021 19:03:47 GMT

I'm testing out pre-logon always on VPN with a pretty basic setup. My pre-logon tunnel is coming up and seems to work fine, however I am not seeing any hits on a permit any/any security policy rule that has the source users set to "pre-logon". Nothing in the traffic log either, just shows a blank user for traffic prior to successful user auth. User ID works after user auth and shows the actual user in the traffic logs / using proper matched policy rules.

I see this: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXlCAK

But that's pretty out dated...

Is there something obvious I'm missing?

Re: pre-logon - not seeing "pre-logon" user in traffic logs / 0 hits on pre-logon policy rules

nikoolayy1 — Thu, 13 Jan 2022 10:19:48 GMT

This is normal to not see the prelogon user in the traffic logs:

Pre-logon User Does Not Appear in Traffic Logs - Knowledge Base - Palo Alto Networks

Re: pre-logon - not seeing "pre-logon" user in traffic logs / 0 hits on pre-logon policy rules

jgardner150 — Thu, 13 Jan 2022 14:01:49 GMT

Thanks for the reply and yes agreed there won't be a user in the traffic logs. However there should at least hits on the rules that are made for the pre-login user.

I did end up figuring this out and forgot to post. In my environment I have the user-id agents installed and reporting user to ip mappings to the firewalls. I had to exclude the global protect IP range from this as it was overriding the pre-logon user.

Re: pre-logon - not seeing "pre-logon" user in traffic logs / 0 hits on pre-logon policy rules

Nalin_Liyanage — Fri, 30 Sep 2022 14:39:52 GMT

I am having same issue with Prisma GPCS. I can see user pre-logon in globalprotect logs in Panorama but, not in the traffic logs.