topic User-ID from multiple sources - what takes precedence in General Topics

User-ID from multiple sources - what takes precedence

SARowe_NZ — Wed, 03 Jun 2020 04:41:54 GMT

Hi,

We are setting up user-ID with agents on member servers, checking domain controller event logs. We also run an internal globalprotect gateway.

With both active and potentially providing the same user-ip mapping, which one does the firewall user? the one from GP or the one from the DCs?

Thanks,
Shannon

Re: User-ID from multiple sources - what takes precedence

OtakarKlier — Wed, 03 Jun 2020 20:58:46 GMT

Hello,

The last place the PAN checked for the user-id info. If it was source A then that is written in to the user-id DB. If it was source B then it will be written. So its not an order, just where it checked last.

Regards,

Re: User-ID from multiple sources - what takes precedence

SARowe_NZ — Wed, 03 Jun 2020 21:38:52 GMT

Thanks!

Re: User-ID from multiple sources - what takes precedence

mbalakrishnapillai — Sun, 10 Nov 2024 22:32:01 GMT

Also, for people hitting this thread to know the precedence when user-id mapping is learned from GP and User-id Agent

"The firewall is learning ip-user-mapping for the users from multiple sources, GlobalProtect and user-id agents. The firewall will cache the latest user mapping and timeout value therefore any prior user-mapping entry will be overwritten."

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VYFCA2

Result: The firewall will consider whichever mapping is learned last by the firewall