user based policy not working even if the log shows correct username.

Abdul_Razaq — Mon, 09 Nov 2020 07:54:05 GMT

Hi Team,

I am facing an intermittent issue as follows.

- I have a policy based on the username in domain\username format (Domain in NetBIOS name).

I can see sometimes user traffic is not hitting this policy, but the traffic log shows with the correct username (domain\username - hope this eliminates the chance of domain normalization issue).

-As the username in the traffic log is exactly matching, not sure why the traffic was not hitting the policy.

-There is no configuration change, I can see the traffic occasionally miss hitting the policy.

-I am running PanOs 9.1.5 in 3060 with windows based UserID agent.

Thanks!.

Re: user based policy not working even if the log shows correct username.

BPry — Tue, 10 Nov 2020 02:50:48 GMT

@Abdul_Razaq,

First three things I would look at:

1) Looking at the traffic logs everything is exactly the same for the traffic when it is and isn't hitting the expected entry?

2) Does the entry have anything such as a schedule assigned to it that would cause the traffic to no longer match new sessions?

3) Does it match any of the known issues in a later release (like 9.1.6)

HTTP/2 traffic? PAN-145385
SSL forward proxy enabled? PAN-147847

topic Re: user based policy not working even if the log shows correct username. in General Topics

user based policy not working even if the log shows correct username.

Re: user based policy not working even if the log shows correct username.