PAN OS 11.1 USER ID ,POLICY BLOC GROUPS

[V.John]

Hi Paloalto 11.1, user ID agent configured, it's pulling users with ip. 

But using policy to block or allow the internet is not working

It blocks all users; if all domain users are allowed, the internet will be allowed. If a particular group is selected to enable through policy, it is blocked. I can see users in the user ID section and logs.

Please advise 

[Mudhireddy]

User-ID agent is working, but security policies are not. This is a common issue, and the problem is likely in your policy configuration, not the User-ID agent itself.

Primary Fixes to Check:

1. Policy Order: Your specific "allow group" policy must be placed above any broad "allow all users" policy. The firewall processes policies from top to bottom.

2. Group Mapping: Even if user-to-IP mapping works, the group membership might not be. Go to Device > User Identification > Group Mapping Settings and confirm the group you're using in your policy is included and syncing correctly.

3. Source Zone: Ensure the source zone in your policy has "User Identification" enabled.

4. Commit: Always remember to commit your changes for them to take effect.

It's highly probable the issue is with the policy order, which is the most frequent cause of this behavior.