topic Re: PA Traffic is logged under different users other than the logged in user in General Topics

PA Traffic is logged under different users other than the logged in user

ESutedy — Tue, 22 Aug 2017 03:56:32 GMT

Hi guys,

We have a security rule that grant a certain app access to users based on AD group.

User complained that sometime they can access the app and sometime they cant.

Checked the firewall and found out that some of the traffics are logged under different user accounts, hence the right policy didnt get applied.

User is using OSX (mac) and has more than 2 exchange mailboxes connected to the outlook profile.

Is there a way to control this?

Thanks

Re: PA Traffic is logged under different users other than the logged in user

reaper — Tue, 22 Aug 2017 07:03:54 GMT

how is user-ID being performed?

is the second account a shared one that should not have individual access, you could add it to the user-ID ignore user list

Re: PA Traffic is logged under different users other than the logged in user

Roby_Sreejith — Tue, 22 Aug 2017 08:21:23 GMT

does user part of AD group, if not captive portal will be an option

Re: PA Traffic is logged under different users other than the logged in user

Roby_Sreejith — Tue, 22 Aug 2017 08:22:16 GMT

does the username show the same AD domain name or different

Re: PA Traffic is logged under different users other than the logged in user

bmorris1 — Wed, 23 Aug 2017 09:17:05 GMT

Hi Esutedy,

In this situation it may be better to remove the exchange servers from user-id monitoring but I don't know enough about how your user-id and environment set-up to see if that would be the best solution.

As always, I find the best way of doing user-id is using GlobalProtect. Not for the VPN side of it but for internal host detection as this will always identify the correct user and authenticated to the internal gateway on the firewall.

hope this helps,

Ben