topic UserID and VPN in General Topics

UserID and VPN

jdprovine — Tue, 02 Jan 2018 14:10:06 GMT

Is it necessary to have userid enabled on the VPN zone interfaces to see the userids?

Re: UserID and VPN

BPry — Tue, 02 Jan 2018 14:31:58 GMT

@jdprovine

User-ID will need to be enabled on the zone that the GlobalProtect tunnel terminates in.

Re: UserID and VPN

reaper — Tue, 02 Jan 2018 14:37:22 GMT

Enabling userID on a zone tells the firewall it should collect and remember user information per IP for that zone.

So if you do not enable UserID on the VPN zone, the firewall will see the UserID when the user authenticates but then does not proceed to catalog a user-IP mapping

Re: UserID and VPN

jdprovine — Tue, 02 Jan 2018 14:52:03 GMT

@reaper

Thats what I thought Reaper but I wanted to make sure

Re: UserID and VPN

jdprovine — Tue, 02 Jan 2018 14:54:06 GMT

@BPry

Specific zones have been setup for each VPN or which we have 3 VPNs. So it sounds like it does need to be enabled? The sure way to find out is to turn it off , go through the VPN and see LOL

Re: UserID and VPN

jdprovine — Tue, 02 Jan 2018 15:53:25 GMT

I took disable userid identification on one of my VPN zones and it still showw the user information

Re: UserID and VPN

jdprovine — Tue, 02 Jan 2018 16:29:58 GMT

I did some testing and it appears that the userid quits showing in the monitor logs when userid is not enabled for the VPN. But it shows up everywhere else

Re: UserID and VPN

reaper — Wed, 03 Jan 2018 08:02:00 GMT

Did you turn it off and checked immediately? it won't immediately remove existing mappings, it will stop collecting new ones

the opposite is also true: if you enable it, new mappings will only appear for new connections, not for existing ones

Re: UserID and VPN

jdprovine — Wed, 03 Jan 2018 14:03:08 GMT

@reaper

No I stop and started the GP connection and the user information dissappeared when I restarted the session after I disable userid. I tried it a few times and got the same result. But again it only dissappeared in the monitor logs not anywhere else