PAN OS 11.1 USER ID ,POLICY BLOC GROUPS

V.John — Sun, 03 Aug 2025 12:32:53 GMT

Hi Paloalto 11.1, user ID agent configured, it's pulling users with ip.

But using policy to block or allow the internet is not working

It blocks all users; if all domain users are allowed, the internet will be allowed. If a particular group is selected to enable through policy, it is blocked. I can see users in the user ID section and logs.

Please advise

Re: PAN OS 11.1 USER ID ,POLICY BLOC GROUPS

Mudhireddy — Sun, 03 Aug 2025 17:23:23 GMT

User-ID agent is working, but security policies are not. This is a common issue, and the problem is likely in your policy configuration, not the User-ID agent itself.

Primary Fixes to Check:

Policy Order: Your specific "allow group" policy must be placed above any broad "allow all users" policy. The firewall processes policies from top to bottom.
Group Mapping: Even if user-to-IP mapping works, the group membership might not be. Go to Device > User Identification > Group Mapping Settings and confirm the group you're using in your policy is included and syncing correctly.
Source Zone: Ensure the source zone in your policy has "User Identification" enabled.
Commit: Always remember to commit your changes for them to take effect.

It's highly probable the issue is with the policy order, which is the most frequent cause of this behavior.

topic Re: PAN OS 11.1 USER ID ,POLICY BLOC GROUPS in General Topics

PAN OS 11.1 USER ID ,POLICY BLOC GROUPS

Re: PAN OS 11.1 USER ID ,POLICY BLOC GROUPS