Traffic Logs show 2 different source users from same IP

[emarschang]

We are using User Identification and have the user-id agent running on 2 different AD servers.  Also using global protect.  When looking at traffic logs I can filter on my GlobalProtect VPN IP, I can see the source user of my user account, and a source user of another account.  When looking user-id mappings, and look at my VPN IP, I only see my user account.  Any idea what would be causing this?

[vsys_remo]

Hi @emarschang 

Did you really hit enter for the search query in the first screenshot?

As there are 2 hours between the logs in these screenshots it might be possible that the other user disconnected and global protect assigned then this IP to you. At least this is an explanation. If you provide some more logs like the global protect logs we might be able to find the actual reason.

[emarschang]

Sorry for the confusion there on the timestamps.  Next time I catch this happening, ill will try to grab the relative logs/time stamps.

[emarschang]

I finally was able to get some fresh screen shots.  I got a screen shots from the traffic log, user-id log, and url filter log.  I think we can take the global protect out of the equation.  This is happening to internal users as well.  In this example, end user tried to go to you tube, got a blocked page, but it showed his username as the manadmin user.  Not his user account.

[OtakarKlier]

Hello,

What is the timeout setting for your user-id settings? Also what are you using for user-id to perform the mapping, active directory logs, etc.?

Regards,