user-id agent sending IP mapping with blank/no username

[Carracido]

Dear community,

I have an environment where I monitor the AD servers with Windows user-ID agents to retrieve the user-ip mappings

There are users with several AD accounts and it´s normal seeing the same IP being mapped to different usernames deppending on what resources the user gets access to.

Sometimes I see randomly in the traffic logs the username blank associated to the IPs and the deny policies are applied to this traffic. It happens like this:

Minute X: user-mapping is okay

Minute X+1: user-mapping is blank

Minute X+3: user-mapping is okay again

I checked with "show log userid ip in <IP> direction equal backward" what mapping the user-id agent are sending and I realized that when I see no-mapping or blank mapping on the traffic logs, the mapping the user-id agent is sending to the firewall associated to the IP is the machine name. Like this: domain\machine_name

Is expected the user-id agent sending the mapping in that format?

Thank you for your answers.

[kiwi]

Hi @Carracido ,

Did you know you can ignore users in User-ID ?

Generally, this is used for service accounts, but any desired username can be entered:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClklCAC

Hope this helps,

-Kiwi.