About GeorgiosFakis

Hi ,   Yes that it is but keep in mind your logging will not be correct because the IP mapping will stay in the firewall for a long time.  This will might cause issues in your logs for other USER-ID for IP mapping for other zones like server zones where username will stay there.    For example , if you have a server let's say that is doing some service and has a service account and you RDP , the logs and the IP mapping will have for everything your username unless someone else RDP the server.        ... View more

Hi ,   Are they RDP with the same account like the login username of GP ?  Have you defined AD groups in the ACL ?    What username is not matching the RDP and the DNS and have you compared that to the username login ?  I had the same issue and I deleted the source user AD group because I had users like domain\bob and the RDP was done by domain\admbob.      ... View more

When the user disconnects from GP there are session that will expire, therefore there is no HIP data at the moment . I have seen in my logs that is matching a "catch" rule DENY for those HIP profiles are not working.  ... View more

If they do VPN from China outside China then great firewall of China is doing rate limiting .   I have seen that to many connections even with Palo Alto networks updates and not only with VPN connections . ... View more

Hi ,   Check the user-id how is formatted in the logs like :  domain\bob Then check the traffic logs that you interested and check there the user , it should be something else and that is the reason why  Then check the security policy to see if you have domain\bob like the user ID . The HIP collection is taking the username and domain.  ... View more