PA Traffic is logged under different users other than the logged in user

[ESutedy]

Hi guys,

We have a security rule that grant a certain app access to users based on AD group.

User complained that sometime they can access the app and sometime they cant.

Checked the firewall and found out that some of the traffics are logged under different user accounts, hence the right policy didnt get applied.

User is using OSX (mac) and has more than 2 exchange mailboxes connected to the outlook profile.

Is there a way to control this?

Thanks

[reaper]

how is user-ID being performed?

is the second account a shared one that should not have individual access, you could add it to the user-ID ignore user list

[Roby_Sreejith]

does user part of AD group, if not captive portal will be an option

[Roby_Sreejith]

 does the username show the same AD domain name or different 

[bmorris1]

Hi Esutedy,

In this situation it may be better to remove the exchange servers from user-id monitoring but I don't know enough about how your user-id and environment set-up to see if that would be the best solution.

As always, I find the best way of doing user-id is using GlobalProtect. Not for the VPN side of it but for internal host detection as this will always identify the correct user and authenticated to the internal gateway on the firewall.

hope this helps,

Ben