At the time of this writing, the process for redistributing User-ID info from Prisma Access to on-prem firewalls is documented publicly here:
However this document does not capture an important caveat. In the case of multiple Service Connections existing, each GlobalProtect Gateway nodes will share the User-ID info with 1 of the Service Connection nodes, usually the closest node to it. For example I was working on a tenant with Service Connections in US-West and Us-Northwest. When I logged into a gateway based in US-Northwest, the US-Northwest Service connection received my user-id info, but the US-West Service Connection did not.
This is important because if you're going to follow the above linked process, you will have to reference multiple/all service connections user agent IP addresses in order to get the info on all users coming in via GlobalProtect. I suggest using the following resources to identify if user <-> ip mappings have propagated to the local firewalls:
And as always, after you redistribute, make sure to enable User-ID on the zones on the on-prem firewalls.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!