Policy with user ID don't work in palo alto networks

Reply
L2 Linker

Policy with user ID don't work in palo alto networks

Hello,

 

I have configured the users in the office to be identify with Active Directory. I can see the users identification in the Monitor tab. But when i set a rule with user AD identifier don't work!

 

I add two rules :

 

rule 1: deny access for a specific AD users to social networks

rule 2: allow access to any users  (internet access).

 

The first rulee always don't take effect . I saw the users always access to all sites with the second rule.

 

There is any suggestion please . 

 

Thank you for help.

 

 

Community Team Member

Re: Policy with user ID don't work in palo alto networks

Hi @ra7oub4,

 

Can you add more details about how the rules are configured and how the firewall is logging the actual sessions ?

 

Cheers !

-Kiwi.

L3 Networker

Re: Policy with user ID don't work in palo alto networks

hello ,

 

the identification is enable on your zones ?

DEvice>network>zone> check the box "enable identification" in zone parameters

 

L7 Applicator

Re: Policy with user ID don't work in palo alto networks

Click on mag glass and see what is session end reason.

Also go to URL filter log and see what action is for those users accessing unwanted sites.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
L7 Applicator

Re: Policy with user ID don't work in palo alto networks

from CLI.

 

show user group list

 

copy the fqdn for the restricted group.

 

show user group name "paste fqdn"   (use quotes if fqdn has spaces)

 

scroll down to ensure users are in that group and ensue domain\ is same as username in policy.

 

 

L7 Applicator

Re: Policy with user ID don't work in palo alto networks

To identify user's group membership it is easier to use following command:

> show user user-ids match-user raido

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE (3.0, 5.0, 6.0, 7.0), PCNSE (6, 7), PCNSI
L7 Applicator

Re: Policy with user ID don't work in palo alto networks

Noted...    thankyou.

L2 Linker

Re: Policy with user ID don't work in palo alto networks

Hello,

 

Thank you very much for your helps.

 

The problem is solved .

 

 

Thank you very much for all your response.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!