User-ID from multiple sources - what takes precedence

[SARowe_NZ]

Hi,

We are setting up user-ID with agents on member servers, checking domain controller event logs. We also run an internal globalprotect gateway.

With both active and potentially providing the same user-ip mapping, which one does the firewall user? the one from GP or the one from the DCs?

Thanks,
Shannon

[OtakarKlier · Accepted solution]

Hello,

The last place the PAN checked for the user-id info. If it was source A then that is written in to the user-id DB. If it was source B then it will be written. So its not an order, just where it checked last.

Regards,

[SARowe_NZ]

Thanks!

[mbalakrishnapillai]

Also, for people hitting this thread to know the precedence when user-id mapping is learned from GP and User-id Agent

"The firewall is learning ip-user-mapping for the users from multiple sources, GlobalProtect and user-id agents. The firewall will cache the latest user mapping and timeout value therefore any prior user-mapping entry will be overwritten."

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000001VYFCA2

Result: The firewall will consider whichever mapping is learned last by the firewall