topic Re: Source User Doesn't Show in General Topics

Source User Doesn't Show

Mahmoud-Osama — Tue, 10 Apr 2018 11:09:36 GMT

Dears,

I have a problem with uses coming from WIFI and non-joined domain the source user doesn't show and show a blank please find the image.

I have installed the CA's for our domain and the PA put didn't work.

Our infrastructure as shown below.

Wireless Controller "Cisco Aironet 1850 Series Mobility Experss"

Re: Source User Doesn't Show

reaper — Tue, 10 Apr 2018 11:44:31 GMT

There are a few things that could be missing: did you enable user-ID on the wifi-staff zone?

is the user showing up in the user-id agent?

do you have captive portal enabled as backup mechanism?

have you set up separate user-id agents for the non-joined domain ?

is the user showing in

admin@PA-220> show user ip-user-mapping ip 10.3.11.12

Here's an article with more information how to make sure everything is covered: https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-User-ID/ta-p/69321

Re: Source User Doesn't Show

Mahmoud-Osama — Thu, 12 Apr 2018 07:22:39 GMT

Thank you for your response.

is the user showing in

admin@PA-220> show user ip-user-mapping ip 10.3.11.12

no didn't shown.

No matched record

did you enable user-ID on the wifi-staff zone?

Yes, the user-ID is enabled on WIIF-Staff Zone

is the user showing up in the user-id agent?

No, the user doesn't show on the Palo Alto Network User-ID Agent

do you have captive portal enabled as a backup mechanism?

No, the captive portal not enabled

Re: Source User Doesn't Show

reaper — Thu, 12 Apr 2018 07:51:43 GMT

Hi @Mahmoud-Osama

Then the behavior on the firewall is normal, you'll need to address one of the perifery issues:

-why is the userID agent not populating the logins: is the AD they use to authenticate being polled/monitored, or does it have it's own agent? is 'log audit success' enabled in the local security policies of the AD?

you may need to install a separate user-id agent for the non-joined domain you mentioned, and attach that to the firewll specifically for these users

Re: Source User Doesn't Show

TerjeLundbo — Thu, 12 Apr 2018 10:32:28 GMT

Typically wireless clients are authenticated by Radius, so information about user name and IP address will not appear in the security logs on the domain controllers. So you will have to setup your Radius server or your wireless controllers to send the information to PA. This can be done for example using XML-API or Syslog.

Re: Source User Doesn't Show

Mahmoud-Osama — Thu, 12 Apr 2018 11:21:39 GMT

Thanks i will try and let you know what is happen.