User-ID two usernames being identified by User-ID servers

[DanielBostock]

Hi,

I am having troubles with getting the Palo's in my network to only use the UPN of a user in our environment. I would like to start creating security policies to control staff members access to resources based on their AD user rather than IP address and then further to that leverage groups. Long term of course the idea is to leverage AD groups to control access to resources, however I need to prove that this will work on individual users first.

It is not working currently because what I am seeing in the monitor logs is either domain\user.name or user.name@domain.local  and because of this whenever I make a security policy sometimes it works for the end user and then the next moment it doesn't work. It will work 100% of the time if I update the policy to domain\user.name and user.name@domain.local . This of course is not practical and scalable.

Currently we are using 2 Palo Alto Windows Server Agents to get the access data from our AD servers. Palo Alto monitor logs are reporting back connected and the User-ID log shows the source as being either of these servers.

Here is some screenshots of our current configuration for the user & group mapping.

Are there additional settings, or things I need to be doing to resolve this and either only match on domain\user.name or user.name@domain.local

Thanks.

[reaper]

if you want everything to be UPN, you'll need to set userPrincipalName in the User Object Search Filter, and in the primary Username, or set sAMAccountName in both

[DanielBostock]

@reaper  - Thanks for your assistance here. I have updated the settings to match this but I am still seeing the duplicate username in the monitor traffic log and user-id log. Is this still expected? If this is expected and normal, I will do some policy testing just using the UPN.

Thanks.

[kgopichand]

@DanielBostock 

Just wondering if this document would help.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpsCAC

Kavi

[DanielBostock]

@kgopichand- Thanks for sharing this post but I have already followed this guide and it sadly did not fix the issue.

Thanks,