About apasupulati

If all the ip-mappings are discovered on the agent and not the firewall - 1. Are these users from a different subnet coming from a different source zone? all the source zones will need to have User-Id enabled so users can be identified on the firewall. 2. If coming from the same zone as the identified subnet, I'd re-check if the zone has any User-id ACL (include/exclude list) configured. ... View more

Hello Adam, Since you mentioned this was working on PANOS 5.0.7, was the device upgraded or is that on a different firewall? Can you clarify if you're using the agent or the agentless? Do you have any include or exclude lists configured? Under the zone configuration or the user-id config. Pick a user machine whose mapping is not learnt and verify the logon server. Run "set l" at the windows cmd prompt to see which logon server the user logged onto. Confirm the user-id service is connected to the logon server/DC. If everything is setup correctly, we'd have to look at the logs. If using agentless, you can enable debugs for user-id service and tail the useridd.log. Or you can enable debug level logging on the user-id agent and check the Uadebug logs in the agent's directory. You can also refer: https://live.paloaltonetworks.com/docs/DOC-5662 Regards, Aditi ... View more

Hello, With IPsec mode enabled for GP, the client will make an ipsec connection first and use SSL connection as a fall back. Aditi ... View more