Local user Identification issue

[PankajDhobe]

As per the below mention snap-shot, we observed user id get changed with AD user and we have allowed the internet access to local user id which is configured in Palo Alto. Due to issue user facing internet issue.

We have not configure this user in AD domain, then how user id gets change in  the Palo Alto automatically ?

While authenticating via AD traffic is going via cleanup rule.

What should be done, so traffic will authenticate locally?

Sometimes machine authenticated locally sometime by AD though machine is not in domain

[reaper · Accepted solution]

my first guess would be that you have probing enabled on the user-id agent.

if the firewall receives a connection from an IP in a user-id enabled zone for which there is no mapping, it will query the user-id agent

if the agent has no mapping and probing is enabled, it will poll the machine for the 'logged in' credentials and feed those to the firewall if the machine replies

this seems the most likely reason why you're seeing a username you don't have in your ID (its what the machine tells the probe)