topic Re: Policy with user ID don't work in palo alto networks in General Topics

Policy with user ID don't work in palo alto networks

ra7oub4 — Wed, 27 Sep 2017 09:57:53 GMT

Hello,

I have configured the users in the office to be identify with Active Directory. I can see the users identification in the Monitor tab. But when i set a rule with user AD identifier don't work!

I add two rules :

rule 1: deny access for a specific AD users to social networks

rule 2: allow access to any users (internet access).

The first rulee always don't take effect . I saw the users always access to all sites with the second rule.

There is any suggestion please .

Thank you for help.

Re: Policy with user ID don't work in palo alto networks

kiwi — Wed, 27 Sep 2017 11:35:43 GMT

Hi @ra7oub4,

Can you add more details about how the rules are configured and how the firewall is logging the actual sessions ?

Cheers !

-Kiwi.

Re: Policy with user ID don't work in palo alto networks

alle — Wed, 27 Sep 2017 13:09:31 GMT

hello ,

the identification is enable on your zones ?

DEvice>network>zone> check the box "enable identification" in zone parameters

Re: Policy with user ID don't work in palo alto networks

Raido_Rattameister — Wed, 27 Sep 2017 13:55:31 GMT

Click on mag glass and see what is session end reason.

Also go to URL filter log and see what action is for those users accessing unwanted sites.

Re: Policy with user ID don't work in palo alto networks

Mick_Ball — Wed, 27 Sep 2017 14:20:56 GMT

from CLI.

show user group list

copy the fqdn for the restricted group.

show user group name "paste fqdn" (use quotes if fqdn has spaces)

scroll down to ensure users are in that group and ensue domain\ is same as username in policy.

Re: Policy with user ID don't work in palo alto networks

Raido_Rattameister — Wed, 27 Sep 2017 14:23:44 GMT

To identify user's group membership it is easier to use following command:

> show user user-ids match-user raido

Re: Policy with user ID don't work in palo alto networks

Mick_Ball — Wed, 27 Sep 2017 14:28:56 GMT

Noted... thankyou.

Re: Policy with user ID don't work in palo alto networks

ra7oub4 — Thu, 28 Sep 2017 15:26:49 GMT

Hello,

Thank you very much for your helps.

The problem is solved .

Thank you very much for all your response.