user based policy not working even if the log shows correct username.

[Abdul_Razaq]

Hi Team,

I am facing an intermittent issue as follows.

- I have a policy based on the username in domain\username format (Domain in NetBIOS name).

I can see sometimes user traffic is not hitting this policy, but the traffic log shows with the correct username (domain\username - hope this eliminates the chance of domain normalization issue).

-As the username in the traffic log is exactly matching, not sure why the traffic was not hitting the policy.

-There is no configuration change, I can see the traffic occasionally miss hitting the policy.

-I am running PanOs 9.1.5 in 3060 with windows based UserID agent.

Thanks!.

[BPry]

@Abdul_Razaq,

First three things I would look at:

1) Looking at the traffic logs everything is exactly the same for the traffic when it is and isn't hitting the expected entry? 

2) Does the entry have anything such as a schedule assigned to it that would cause the traffic to no longer match new sessions?

3) Does it match any of the known issues in a later release (like 9.1.6)

• HTTP/2 traffic? PAN-145385
• SSL forward proxy enabled? PAN-147847