USER_ID mapping constantly changing with Zscaler App

UtkarshKumar — Fri, 08 Mar 2024 02:54:07 GMT

Hi Team,

We are facing an issue where PA user authenticated access from ZScaler app connect servers is failing intermittently.

Access through PA FW to a server network using user authentication is failing intermittently when connections are made from a pair of ZScaler app connector servers.

CLI command "show user ip-user-mapping ip-address-of-ZPA" shows that the userid associated with the ZPA connectors is constantly changing.

FW logs do not show anything for the connections that are not completed successfully. The FW logs do report connections that fail the userid authentication rules, by logging unauthenticated access attempts with the last 'deny all' clean up rule of the policy.

Successful connections are allowed & logged by the userid authentication rule, including the source user information.

Server connections made from non-ZPA connectors, i.e. single user hosts, appear to be working successfully using the same userid authentication rule.

We have latest 10.2.8 FW running and would like toc heck if anyone faced any similar issue or where can we check to see why this is happening.

Thanks

topic USER_ID mapping constantly changing with Zscaler App in Next-Generation Firewall Discussions

USER_ID mapping constantly changing with Zscaler App