Global Protect User ID not showing if connected to internal GW

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Global Protect User ID not showing if connected to internal GW

L0 Member

Hello all,

we have an issue that the User ID is not shown on the Palo if the GP Client is connected to the internal network.

The detection is working but in the logs I can't see any user informations of internal connected clients.

 

For our Global Protect Clients we are using pre-auth.

Settings for pre-auth and for the User Configs, both the same.

 

smindorf_0-1727430224035.png

smindorf_1-1727430278567.png

 

Authentification is against Active Directory.

External we have no problem, all Rules are based on Active Directory groups and it is working.

 

If the User is internal Global Protect shows internal connection. But I can't see any user name in the Palo logs, but I can see connection informations like Username, Application...

 

I' hv also read docs like:

 

User-ID Best Practices for GlobalProtect (paloaltonetworks.com)

 

but it is not working. Maybe I missed some settings.

On the LAN Zone, where the internal clients are connecting to is User ID enabled.

 

smindorf_2-1727430625673.png

Any hints where I can find a solution?

 

Palo Infos:

Model PA-3260

Software Version 10.2.11-h1

GlobalProtect Agent 6.2.3

 

Kind regards,

Sören

 

1 REPLY 1

L2 Linker

My company only uses the internal gateway detection to turn off gp, when connected to internally.  But in any case you should be able to detect the users with the user id agent, if you have it scan the logs of domain controller or a file/print server that everyone uses.  I'm not sure why global portect is not logging.  You might want to open a ticket, so support can see all the sensitive settings to determine why that isn't being logged.

 

Also there is a privilege escalation vulnerability with 6.2.3 client and older 6.2 releases.  https://www.tenable.com/cve/CVE-2024-5915 and https://security.paloaltonetworks.com/CVE-2024-5915  5.2 on CVSS v4, 7.8 on CVSS v3 and 6.8 on CVSS 2.0.  These different cve scales are clear as mud... 

  • 188 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!