pre-logon - not seeing "pre-logon" user in traffic logs / 0 hits on pre-logon policy rules

[jgardner150]

I'm testing out pre-logon always on VPN with a pretty basic setup. My pre-logon tunnel is coming up and seems to work fine, however I am not seeing any hits on a permit any/any security policy rule that has the source users set to "pre-logon". Nothing in the traffic log either, just shows a blank user for traffic prior to successful user auth. User ID works after user auth and shows the actual user in the traffic logs / using proper matched policy rules.

I see this: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXlCAK 

 But that's pretty out dated... 

Is there something obvious I'm missing? 

[nikoolayy1]

This is normal to not see the prelogon user in the traffic logs:

Pre-logon User Does Not Appear in Traffic Logs - Knowledge Base - Palo Alto Networks

[jgardner150 · Accepted solution]

Thanks for the reply and yes agreed there won't be a user in the traffic logs. However there should at least hits on the rules that are made for the pre-login user. 

I did end up figuring this out and forgot to post. In my environment I have the user-id agents installed and reporting user to ip mappings to the firewalls. I had to exclude the global protect IP range from this as it was overriding the pre-logon user. 

[Nalin_Liyanage]

I am having same issue with Prisma GPCS. I can see user pre-logon in globalprotect logs in Panorama but, not in the traffic logs.