Palo Alto Networks Certified Network Security Engineer (PCNSE)Core ConceptsHard
A security auditor is reviewing the logging configuration of a Palo Alto Networks firewall and notices that some traffic logs are missing details about the specific user associated with the session. The firewall has User-ID enabled and configured. Which of the following is the most likely reason for the missing User-ID information in the logs?
- AThe User-ID agent is not properly configured to collect user mappings.
- BThe firewall is not configured to send logs to an external syslog server.
- CThe security policy rule allowing the traffic does not have User-ID enabled.
- DThe log forwarding profile attached to the security policy is incomplete.
Show answer & explanationAnswer & explanation
Correct answer: A. The User-ID agent is not properly configured to collect user mappings.
For User-ID information to appear in logs, the User-ID agent must be correctly configured and operational to collect user-to-IP address mappings. If the agent isn't collecting or communicating these mappings to the firewall, the firewall won't have the user information to include in the session logs, even if User-ID is generally enabled.
Why the other options are wrong
- B. Sending logs to an external syslog server is about *where* logs go, not *what* information they contain.
- C. User-ID is applied globally or via zones; the security policy rule itself doesn't 'enable' User-ID, but rather *uses* the information it provides.
- D. An incomplete log forwarding profile would affect *delivery* of logs, not the *content* of the logs generated by the firewall.
User-ID Agent Configuration
Proper configuration of the User-ID agent is crucial for the Palo Alto Networks firewall to collect and utilize user-to-IP address mappings for policy enforcement and logging.
- Collects user-to-IP mappings from various sources (AD, syslog, client probes).
- Communicates mappings to the firewall.
- Essential for populating User-ID fields in logs and policies.
Memory trick: User-ID missing? Agent's the key, mapping must be free!