# User-ID: the firewall must know the name, not only the IP Source: https://ai.techclick.in/blog_paloalto_userid_sources_mapping Markdown: https://ai.techclick.in/blog_paloalto_userid_sources_mapping.md Publisher: Techclick Infosec Pvt Ltd Learn Palo Alto User-ID: map IP to username, choose agent vs syslog vs GlobalProtect, enable User Identification on the zone, and prove empty Source User with dummy CLI. ## The ticket Dummy site: Mumbai office. Firewall fw-mum-01 . HR users sit in zone trust-l3 . Rule allow-hr-sap is Source Zone trust-l3 , Source User TECHCLICK\hr-users , destination the SAP VIP. Rahul’s laptop is 10.20.30.81 . Traffic log: session allowed? No — it hits the next rule, or it denies, and Source User is blank . If you add “any” user to make SAP work, you hid the real fault. The rule is fine. The name never arrived. Quick interview answer User-ID maps an IP address to a username (and, separately, usernames to groups). Enable User Identification on the trusted source zone. Collect mappings with a Windows User-ID agent, the PAN-OS integrated agent, syslog, GlobalProtect, Authentication Portal, TS agent, or XML API. Then prove it with show user ip-user-mapping ip 10.20.30.81 . Palo Alto: “Enable User-ID on the source zones that contain the users.” Never enable User-ID and client probing on an untrusted internet zone. Hero · a name replaces the IP Policy matches a user only after a mapping exists. No mapping = the rule that requires a user will never hit. ## What User-ID actually is PAN-OS has two different jobs that students mix: User mapping answers “which username owns this IP right now?” That is ip-user-mapping . Group mapping answers “which AD/LDAP groups is that username in?” That is what fills the Source User drop-down with TECHCLICK\hr-users . A traffic log can show a username and still miss a group-based rule if group mapping is down. Or it can show an empty user even when the group object exists in the rule — because the IP was never mapped. Flow 1 · two tables, one policy hit IP maps to user, user maps to group, then policy can match - 10.20.30.81 packet source IP ip-user-mapping TECHCLICK\rahul.mehta group mapping TECHCLICK\hr-users allow-hr-sap Source User matches If the first arrow is missing, the group object in the rule is decoration. Say this out loud User mapping names the IP. Group mapping names the club. Security policy can use either. An empty Source User means the first table missed — not that AD is “down” until you prove it. Lab data · dummy only FW fw-mum-01 · zone trust-l3 · user TECHCLICK\rahul.mehta · IP 10.20.30.81 · DC dc01.techclick-lab.in · Windows agent 10.10.10.15:5007 · group TECHCLICK\hr-users . Not a live customer. ## Which mapping source How to choose Domain PCs → agent. NAC / wireless / proxy → syslog. Remote users → GlobalProtect. Unknown users → Authentication Portal. Source What it watches Use when Main lie Windows User-ID agent DC / Exchange security logs (login events) Most Windows offices; many DCs Agent down or service account too weak → silent empty users PAN-OS integrated agent Same job, runs on the firewall Few DCs, small site, or syslog over TLS Firewall CPU + DC query load; still needs a dedicated service account Syslog listener Auth logs from WLC, 802.1X, NAC, proxy Users who never hit a Windows DC Parse profile wrong = no mapping. TLS syslog is preferred on the integrated agent GlobalProtect The GP login itself Remote / hybrid users Office LAN users are not mapped just because GP exists TS agent Per-user ports on a terminal server Citrix / RDS — many users, one IP Without it, one IP = one (wrong) user Authentication Portal User authenticates in the browser Linux / BYOD / last-resort; overrides other methods Not a replacement for DC monitoring on domain PCs XML API You push mappings Custom NAC / lab You own the timeout and the cleanup Official warning · do not skip Palo Alto: enable User-ID on trusted zones only . If you enable User-ID and client probing on an external untrusted zone, probes can leak the agent service-account name, domain, and an encrypted password hash. Also: “do not enable client probing as a user mapping method on high-security networks.” ## How you configure it Three sides. Side A is identity sources. Side B is the firewall zone + include list. Side C is the Security rule and the User-ID app itself. ### Side A — collect mappings (agent / syslog / GP) GUI: Device → User Identification → User Mapping (server monitoring / include-exclude). For a Windows agent, install the agent near the DCs, then point the firewall at it. Official: create a dedicated service account with the minimum rights — do not use Domain Admin. https://fw-mum-01.techclick-lab.in/…/user-identification/user-mapping Training mock · not live Device → User Identification → User Mapping ### Server Monitoring Name dc01-sec-log Type Microsoft Active Directory Network Address dc01.techclick-lab.in Status Connected Include list (best practice) 10.20.30.0/24 Cancel OK · Commit Source: PAN-OS Enable User-ID / integrated agent — Device → User Identification → User Mapping. Always set include/exclude networks. Side A · dummy CLI after commit show user server-monitor state all Server: dc01-sec-log type: AD status: Connected vsys: vsys1 show user user-id-agent state all Agent: uid-agent-01 10.10.10.15:5007 status: connected version: 11.0.2-xx Group mapping is a second object: Device → User Identification → Group Mapping Settings → LDAP server profile. Official: map users to groups so you can select group names in policy. Prefer group-based rules so you do not commit on every joiner/leaver. ### Side B — turn User-ID on the zone GUI: Network → Zones → trust-l3 → Enable User Identification . This is the step students skip. Mappings can exist on the firewall and still never stamp the session if the ingress zone is not User-ID enabled. https://fw-mum-01.techclick-lab.in/…/network/zones/trust-l3 Training mock · not live Network → Zones → trust-l3 ### Zone Name trust-l3 Type layer3 Enable User Identification ☑ Enabled (trusted zone only) Enable User Identification on untrust? ☐ No — official: trusted zones only Cancel OK · Commit Source: Enable User-ID — “Select [Network → Zones] and click the Name of the zone. Enable User Identification.” ### Side C — policy + protect the User-ID app GUI: Policies → Security → User tab → Source User . Official options include a specific user/group, or known-user / unknown . Also allow application paloalto-userid-agent only between agents, DCs, and firewalls. Deny it to the internet zone. On HA, enable config sync so mappings/groups stay with the peer. Side C · dummy policy idea # Rule allow-hr-sap # Source Zone: trust-l3 # Source User: TECHCLICK\hr-users # Destination: sap.techclick-lab.in # App: sap # Action: allow # Log at session end: yes ## Four User-ID failures Policy has a user · log does not This picture is the whole ticket. Do not widen the rule until you can explain the blank field. ### 1 · User-ID not enabled on the source zone What this is. Agent is Connected. show user ip-user-mapping ip 10.20.30.81 even shows Rahul. Traffic log Source User is still empty. Zone trust-l3 does not have User Identification ticked. Broken · dummy show zone trust-l3 user-id: no show user ip-user-mapping ip 10.20.30.81 IP Vsys From User 10.20.30.81 vsys1 AD TECHCLICK\rahul.mehta # Mapping exists. Session is not stamped. Enable User Identification on the zone. Takeaway. Mapping table ≠ session stamp. The zone checkbox is the stamp. ### 2 · Include list missed the subnet (or client probing is the only method) What this is. Include list is 10.20.10.0/24 . Rahul is on 10.20.30.81 . No mapping is created. Or someone enabled WMI/NetBIOS client probing instead of security-log monitoring and it is blocked or unsafe. Broken · dummy show user ip-user-mapping ip 10.20.30.81 No ip-user-mapping # Fix include list to 10.20.30.0/24, then wait for a new login event # or have Rahul lock/unlock the PC so the DC writes a logon event Takeaway. Official best practice: always set include and exclude networks. Do not use client probing as the main method on a high-security network. ### 3 · Many users, one IP — Citrix / RDS without TS agent What this is. Twenty HR users share 10.20.40.10 on a terminal server. User-ID thinks that IP is one person. Policy and logs lie for everyone else. Takeaway. Official: Windows multi-user systems need the Terminal Server (TS) Agent . Non-Windows multi-user systems use the XML API. ### 4 · Group mapping down — user is known, group rule misses What this is. Traffic log shows TECHCLICK\rahul.mehta . Rule uses TECHCLICK\hr-users . LDAP group mapping is disconnected, so the firewall does not believe Rahul is in that group. Broken · dummy show user ip-user-mapping ip 10.20.30.81 10.20.30.81 vsys1 AD TECHCLICK\rahul.mehta show user group-mapping state all Group Mapping: gm-techclick ldap-server: ldap-techclick last-success: 2 days ago status: connection failed show user group name "cn=hr-users,ou=groups,dc=techclick-lab,dc=in" # rahul.mehta not listed — mapping stale Takeaway. Prove both tables. A username in the log is not proof a group-based rule will hit. ## How to prove it Proof cockpit Proof is three artefacts: zone User-ID on, mapping present, traffic log Source User filled for that IP. Flow 2 · prove the name before you widen the rule Five User-ID proof steps 1. zone User-ID trust only 2. agent / DC Connected 3. ip-user-map this source IP 4. group map if rule uses group 5. traffic log Source User set On redistribution clients, official check: show user ip-user-mapping all and From = REDIST . Proof ladder · dummy show zone trust-l3 show user server-monitor state all show user user-id-agent state all show user ip-user-mapping ip 10.20.30.81 show user ip-user-mapping all | match 10.20.30 show user group-mapping state all show user group name TECHCLICK\hr-users show log traffic query "addr.src in 10.20.30.81" direction equal backward Proof the change worked Zone trust-l3 has User Identification enabled. untrust does not. - Agent or server-monitor status is Connected. - show user ip-user-mapping ip 10.20.30.81 shows TECHCLICK\rahul.mehta . - If the rule uses a group, that user is listed in the group mapping. - New session: traffic log Source User is filled; rule allow-hr-sap hits. - You did not set Source User to any to “make it work.” ## Traps Trap Looks like First proof Do not Empty Source User Group rule never hits Zone User-ID + ip-user-mapping for that IP Change the rule to any user first. User-ID on untrust “We enabled it everywhere” Zone list Turn on client probing toward the internet. Stale DHCP mapping Wrong user on a new laptop Mapping timeout vs DHCP lease Blame the SAP team. Proxy / Zscaler egress One IP, many people X-Forwarded-For Header in User-ID (Device → Setup → Content-ID) Treat the proxy IP as one employee. Redistribution miss Hub has users, spoke does not From = REDIST on the client FW Install a second agent on every spoke blindly. Domain Admin as agent account It works, audit fails Service account rights Leave Domain Admin in production. Interview close: “User-ID is an IP-to-user table plus a user-to-group table. I enable it on the trusted source zone, I name the mapping source, and I prove it with ip-user-mapping and the traffic-log Source User. An empty user is a mapping problem until those two proofs say otherwise.” ## Knowledge check Eight judgment questions. Pick one, then Check. Q1 What does User-ID primarily store so a Security rule can match Source User? The MAC address of the laptop An IP-address-to-username mapping (and separately, user-to-group mapping) The App-ID signature pack The default route Correct: b . Re-read “What User-ID actually is.” Q2 Where does Palo Alto tell you to enable User-ID first? On the untrust / internet zone, so guests are identified Only on the management interface On the trusted source zones that contain the users (Network → Zones → Enable User Identification) Only inside WildFire Correct: c . Official Enable User-ID step 1. Untrust + probing is an information-disclosure risk. Q3 Rule uses TECHCLICK\hr-users. Traffic log Source User is empty for 10.20.30.81. First proof? Zone User-ID on? Then show user ip-user-mapping ip 10.20.30.81 Disable Threat Prevention Change NAT to dynamic-ip-and-port Upgrade PAN-OS immediately Correct: a . Failures 1–2. Do not widen the rule first. Q4 Twenty users on one Citrix / RDS IP. What official tool maps them separately? More security profile groups QoS classes Zone Protection flood thresholds Terminal Server (TS) Agent (or XML API on non-Windows) Correct: d . Failure 3. One IP cannot be twenty people without TS agent / API. Q5 Why does Palo Alto warn against User-ID + client probing on an external untrusted zone? It disables App-ID Probes can leak the User-ID service account name, domain, and encrypted password hash It breaks HA1 It turns off logging Correct: b . Quoted from Enable User-ID. Trusted zones only. Q6 You can pick TECHCLICK\hr-users in the Security rule drop-down because: Group mapping pulled the group from LDAP / AD WildFire uploaded a verdict The default router has a default route SSL decryption is on Correct: a . Map Users to Groups. Different from ip-user-mapping. Q7 A redistribution client firewall should show mappings with From = WMI SNMP REDIST BGP Correct: c . Official redistribution verify: show user ip-user-mapping all From is REDIST. Q8 In the Security rule User tab, known-user means: Any IPv6 host Only Domain Admins The firewall management user Any user who already has an IP-to-user mapping (authenticated / identified) Correct: d . Official: known-user vs unknown when you do not need a specific name. Check answers Reset Palo Alto series (1 of 10): User-ID → App-ID unknown/override → U-turn NAT → Tap/vwire/L2/L3 → Service routes → Commit/lock/revert → DAG+EDL → test security-policy-match → SSL decrypt failures → GlobalProtect HIP. ## Sources - Palo Alto: Enable User-ID — trusted source zones, dedicated service account, include/exclude, group vs user policy, paloalto-userid-agent, XFF, HA sync. - Palo Alto: Map IP Addresses to Users — Windows agent, integrated agent, syslog, TS agent, XML API, Authentication Portal. - Palo Alto: Configure User-ID redistribution — verify From = REDIST. - Related on Techclick: App-ID + Content-ID + User-ID trilogy · Security policy first match · GlobalProtect · Command center . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt