Policy with user ID don't work in palo alto networks

[ra7oub4]

Hello,

I have configured the users in the office to be identify with Active Directory. I can see the users identification in the Monitor tab. But when i set a rule with user AD identifier don't work!

I add two rules :

rule 1: deny access for a specific AD users to social networks

rule 2: allow access to any users  (internet access).

The first rulee always don't take effect . I saw the users always access to all sites with the second rule.

There is any suggestion please . 

Thank you for help.

[kiwi]

Hi @ra7oub4,

Can you add more details about how the rules are configured and how the firewall is logging the actual sessions ?

Cheers !

-Kiwi.

[alle]

hello ,

the identification is enable on your zones ?

DEvice>network>zone> check the box "enable identification" in zone parameters

[Raido_Rattameister]

Click on mag glass and see what is session end reason.

Also go to URL filter log and see what action is for those users accessing unwanted sites.

[Mick_Ball]

from CLI.

show user group list

copy the fqdn for the restricted group.

show user group name "paste fqdn"   (use quotes if fqdn has spaces)

scroll down to ensure users are in that group and ensue domain\ is same as username in policy.

[Raido_Rattameister]

To identify user's group membership it is easier to use following command:

> show user user-ids match-user raido

[Mick_Ball]

Noted...    thankyou.

[ra7oub4]

Hello,

Thank you very much for your helps.

The problem is solved .

Thank you very much for all your response.