I'm pretty new to Palo and firewalling, so sorry for the lack of info I gave you 😞 We're using a UIA and terminal server agent. Sorry for the faulty info.   Thanks for all your responses so far. Just figured it out I guess 🙂     App-id for internal traffic worked properly.  Same with user-id somehow. Maybe I had a faulty client for my tests yesterday. So my only issue seemed to be the app-id.   I saw that all external requests ended up as incomplete and NAT destination port as 0. So what I missed was, to add the VPN zone to the hide NAT rule. After that, appid was recognized immediately. 🙂   The only thing I'm wondering about is the fact that the user-id gets lost after a longer period of inactivity on the client in the VPN network. Maybe that's cause of the cache settings configured for the user-id?     ... View more