topic Local user Identification issue in General Topics

Local user Identification issue

PankajDhobe — Sat, 30 Jan 2021 08:39:30 GMT

As per the below mention snap-shot, we observed user id get changed with AD user and we have allowed the internet access to local user id which is configured in Palo Alto. Due to issue user facing internet issue.

We have not configure this user in AD domain, then how user id gets change in the Palo Alto automatically ?

While authenticating via AD traffic is going via cleanup rule.

What should be done, so traffic will authenticate locally?

Sometimes machine authenticated locally sometime by AD though machine is not in domain

Re: Local user Identification issue

reaper — Sun, 31 Jan 2021 23:15:04 GMT

my first guess would be that you have probing enabled on the user-id agent.

if the firewall receives a connection from an IP in a user-id enabled zone for which there is no mapping, it will query the user-id agent

if the agent has no mapping and probing is enabled, it will poll the machine for the 'logged in' credentials and feed those to the firewall if the machine replies

this seems the most likely reason why you're seeing a username you don't have in your ID (its what the machine tells the probe)