Global Protect User ID not showing if connected to internal GW

[smindorf]

Hello all,

we have an issue that the User ID is not shown on the Palo if the GP Client is connected to the internal network.

The detection is working but in the logs I can't see any user informations of internal connected clients.

For our Global Protect Clients we are using pre-auth.

Settings for pre-auth and for the User Configs, both the same.

Authentification is against Active Directory.

External we have no problem, all Rules are based on Active Directory groups and it is working.

If the User is internal Global Protect shows internal connection. But I can't see any user name in the Palo logs, but I can see connection informations like Username, Application...

I' hv also read docs like:

User-ID Best Practices for GlobalProtect (paloaltonetworks.com)

but it is not working. Maybe I missed some settings.

On the LAN Zone, where the internal clients are connecting to is User ID enabled.

Any hints where I can find a solution?

Palo Infos:

Model PA-3260

Software Version 10.2.11-h1

GlobalProtect Agent 6.2.3

Kind regards,

Sören

[JustinWoodman]

My company only uses the internal gateway detection to turn off gp, when connected to internally.  But in any case you should be able to detect the users with the user id agent, if you have it scan the logs of domain controller or a file/print server that everyone uses.  I'm not sure why global portect is not logging.  You might want to open a ticket, so support can see all the sensitive settings to determine why that isn't being logged.

Also there is a privilege escalation vulnerability with 6.2.3 client and older 6.2 releases.  https://www.tenable.com/cve/CVE-2024-5915 and https://security.paloaltonetworks.com/CVE-2024-5915  5.2 on CVSS v4, 7.8 on CVSS v3 and 6.8 on CVSS 2.0.  These different cve scales are clear as mud...