About AlexSieber

Not sure what you mean with "client". But if you deploy a Panorama VM or hardware appliance and run that device in Panorama or Management mode - yes you can configure Templates and Devices Groups.   Regards ... View more

you can use multiple UIA instances and devide the network ranges (include/exclude lists) so that each agent has a smaller range to probe.  Besides that you have the options to use captive-portal (with ntlm auth) or much better use global-protect with internal gateways.   you could enable user-id debug logs to find more informations why a mapping was lost, timeout, probing, etc.    debug user-id...   you can check the logs via "less mp-log useridd.log"    You should find serveral articels in this kb regarding user-id debug, for example: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClR1CAK   Regarding your exchange accounts: you should give your own user access rights to the mail-boxes of the people you mentioned. No need to login with the account of the user that left - could also be a legal issue if you "impersonate" that user. ... View more

Did you test from the user-id agent or on the local computer?    When you establish a connection and the ip is unknown this should trigger the probing. Depending on your network you may be blocking the probing on the firewall? Also wmi is quite slow, so check the logs of the UIA if there are a lot of probes pending/queued.   Regarding Exchange server, you can use this as source for user-information too on the UIA - usually you get more user login events on that system. But this would also require that your Exchange is reachable without user information.   When it goes to service-users for software deployment or scans: put those users in the exclude list!       ... View more

the article you mentioned does not cover the permission settings on windows side.   Please use the wmic command mentioned before to test if you receive the userinformation from the client. when you receive an empty response, the permissions are not correct   The network for sure must be in the include list for the firewall to create a ip-user-mapping.       ... View more

It looks like you rely on AD security log for user-id and your probing configuration does not work. So when you login via cable the firewall/UIA learns the mapping from the AD security log, but when you switch network connection I think you get a new IP. As there is no login event on the AD you have no correct user-ip-mapping and the connection is blocked. Did you set the correct permissions for probing? Take a look at: https://live.paloaltonetworks.com/t5/General-Topics/Permissions-of-user-ID-service-account-for-wmi-and-netbios/m-p/206151#M60514   You can check wether your AD account is allowed to get the logged in user via the following cli command on windows:   WMIC /NODE: xxx.xxx.xxx.xxx COMPUTERSYSTEM GET USERNAME   Make sure that you run that command in the context of your UID Agent user! ... View more

yes this is the case, any part of local configuration that also exists in the panorama template will be overwritten.   Local configuration parts that do not exist in the template will remain unchanged, they do not get deleted. ... View more