Palo Alto Networks, Inc. · NASDAQ:PANW

Palo Alto Networks — Technical Presentation (February 2026)

34 slides from Palo Alto Networks's technical presentation, Feb 3, 2026

1. Slide 1: User-ID Deployment and Troubleshooting

   User-ID Deployment and Troubleshooting 3rd February, 2026 © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

2. Slide 2: Agenda

   Agenda ● Palo Alto User-ID: Core Functions ● User-ID Overview ● Palo Alto User-ID Mapping Methods ● Palo Alto User-ID: Common Limitations (NAT Focus) ● Best Practice Considerations ● User to Group Mapping overview ● User to Group Mapping - Domain override ● Normalization ● Troubleshooting IP to User

3. Slide 3: Palo Alto User-ID: Core Functions - User Visibility

   Palo Alto User-ID: Core Functions User Visibility ● Maps IP Addresses to Usernames – Identifies who is generating traffic, not just which device. ● User-Based Traffic Monitoring – View activity by user, group, or department. ● Integration with Directory Services – Works with Active Directory, LDAP,

4. Slide 4: Palo Alto User-ID: Core Functions - User-Based Reporting

   Palo Alto User-ID: Core Functions User-Based Reporting ● Reports by User Instead of IP – Easier investigation and accountability. ● Application Usage by User – See which apps each employee is using. ● Web Activity Tracking – Monitor URLs accessed by specific users. ● Security Incident Attribution –

5. Slide 5: Palo Alto User-ID: Core Functions - Identity-Based Policy Enforcement

   Palo Alto User-ID: Core Functions Identity-Based Policy Enforcement ● Policies Based on User or Group – Security rules can allow/deny traffic by identity. ● Role-Based Access Control – Different access levels for employees, contractors, admins. ● Application Access Control – Limit sensitive apps to

6. Slide 6: User-ID Overview

   User-ID Overview ● User Identification encompasses two primary functions: ○ IP to User Mapping: Mapping of users to their current IP addresses. ○ User to Group Mapping: Mapping users with their associated group(s). ● Both functions will be discussed with the primary focus on troubleshooting. © 2024

7. Slide 7: Palo Alto User-ID Mapping Methods: Server Monitoring

   Palo Alto User-ID Mapping Methods Server Monitoring ● Monitors Authentication Logs – Collects login events from domain controllers. ● Maps User ↔ IP Automatically – Based on successful login records. ● Agent or Agentless Deployment – Can use User-ID agent or direct firewall integration. ● Best for D

8. Slide 8: Server Monitoring - User-ID Agent/Agentless

   Server Monitoring - User-ID Agent/Agentless ● Server Monitoring is one of the most commonly used method of retrieving IP to User information ● The Agent will monitor Security Event Logs to populate IP to User mapping information ● The Agent monitors AD servers for the following events: ○ 4768, 4769,

9. Slide 9: Palo Alto User-ID Mapping Methods: Captive Portal

   Palo Alto User-ID Mapping Methods Captive Portal ● User Authentication via Web Page – Redirects unknown users to a login portal. ● Used When No Login Logs Exist – Helpful for guest networks or unmanaged devices. ● Supports Multiple Auth Methods – LDAP, RADIUS, Kerberos, SAML, etc. ● Creates User-IP

10. Slide 10: Captive Portal

    Captive Portal ● Web form ○ Presents a Captive Portal page for the user to explicitly enter authentication credentials or use client certificate authentication ○ Uses port 6082 for client redirection messages. ○ IP to User mapping format is similar to GlobalProtect as they both utilize authentication

11. Slide 11: Palo Alto User-ID Mapping Methods: GlobalProtect

    Palo Alto User-ID Mapping Methods GlobalProtect ● User Mapping Through VPN Client – User identity learned during VPN login. ● Accurate for Remote Users – Maps off-site users connecting to corporate network. ● Works for Internal & External Access – Enforces identity policies anywhere. ● Provides Devi

12. Slide 12: GlobalProtect - User Authentication

    Globalprotect - User Authentication ● IP to User mapping is directly retrieved from users post authentication ● The mapping format is controlled by the primary username attribute, the user input and the configured User Domain value in the authentication profile ● A valid User Input can have one of t

13. Slide 13: GlobalProtect - User Authentication - LDAP

    Globalprotect - User Authentication - LDAP ● The Login Attribute: Specifies the filter that the firewall uses in the LDAP query towards the server and is sAMAccountName by default, can be set to UserPrincipalName. 2020-10-13 17:07:45.658 +0200 debug: pan_authd_ldap_authenticate(pan_authd_shared_ldap

14. Slide 14: GlobalProtect - User Authentication - SAML

    Globalprotect - User Authentication - SAML ● There is no configurable User Domain option for SAML authentication ● The username and domain information has to be provided by the Idp as an attribute ● We match the attribute sent by the Idp using the Username Attribute field ● Example log from Authd wh

15. Slide 15: Palo Alto User-ID Mapping Methods: XML API

    Palo Alto User-ID Mapping Methods XML API ● Third-Party Integration – External systems send user-IP mappings to firewall. ● Used for Custom Environments – Works with NAC, wireless controllers, or custom apps. ● Automated Identity Updates – Dynamic mapping without manual configuration. ● Flexible & S

16. Slide 16: Palo Alto User-ID: Common Limitations (NAT Focus)

    Palo Alto User-ID: Common Limitations (NAT Focus) ● User-ID Maps User to IP Address – Accuracy depends on visibility of the real client IP. ● NAT Breaks Direct User-to-IP Mapping – Multiple users may appear as a single translated IP. ● Loss of Individual Identity Behind PAT – Firewall cannot disting

17. Slide 17: Best Practice Considerations

    Best Practice Considerations ● Place Firewall Before NAT When Possible – So it sees the original client IP. ● Use GlobalProtect for Remote Users – Provides reliable user identification. ● Deploy Terminal Server Agent (TS Agent) – Helps identify users in shared-IP environments. ● Integrate with Netwo

18. Slide 18: User to Group Mapping overview

    User to Group Mapping overview Main Components ● LDAP Profile ○ Sets the destination server for group mapping ○ Sets the base DN for retrieving the group (Important for domain map) ○ Can connect to LDAP on ports 389/636 or GlobalCatalog on ports 3289/3269 ● Group Mapping Profile ○ Fetches domain gro

19. Slide 19: User to Group Mapping - Domain override

    User to Group Mapping - Domain override ● The User Domain option in group mapping profile can be configured to override the domain for users that are retrieved from the domain server. ● This option does not affect IP to User mapping format ● Should be left empty in almost all scenarios ● Can lead to

20. Slide 20: Normalization

    Normalization ● What is Normalization? ○ The process of converting different username formats from multiple sources to a standard format ○ The primary username attribute is used as the normalized standard format ● Where does Normalization occur? ○ Enumerating users and groups ○ Gathering IP to User m

21. Slide 21: Normalization - Domain Map

    Normalization - Domain Map ● What is a domain map? ○ It is the mapping of the Fully qualified domain name (FQDN) to its equivalent netbios domain name Example: abc.com → abc ● Why do we need the domain map? ○ The firewall needs the domain map so it can normalize the FQDN\Username to Netbios\Username f

22. Slide 22: Troubleshooting IP to User mapping

    Troubleshooting IP to User mapping IP to user mapping issues can can fall under the below categories: ● The mapping is missing on the firewall ○ Possible triggers: ■ Mapping has timed out ■ Mapping is not sent by the source ■ Mapping is received, but the firewall is not accepting it ● The mapping is

23. Slide 23: Troubleshooting IP to User mapping

    Troubleshooting IP to User mapping Start by asking the following questions in order to isolate the issue first: ● Is the mapping present on the firewall during the issue? ○ Check the mapping on the dataplane from CLI ■ show user ip-user-mapping ip <IP address> ● Is this a logging issue? ○ Check sess

24. Slide 24: Troubleshooting IP to User mapping: timeouts

    Troubleshooting IP to User mapping Based on the answers for the previous questions, we should have a better idea on whether this is an early timeout issue or that we are not receiving the mapping entirely. ● User-ID Agent/Agentless timeout issues: ○ Depending on the configured cache timeout on the ag

25. Slide 25: Troubleshooting missing IP mapping

    Troubleshooting IP to User mapping Missing IP mapping due to not receiving or accepting it from the source: ● GlobalProtect Internal gateway or Captive portal: ○ This would happen if authentication is failing, check GP logs (PanGPS.log) and authd.log debugs on the firewall to see why authentication i

26. Slide 26: Troubleshooting missing domain map

    Troubleshooting IP to User mapping Troubleshooting missing domain map 1. Check if the domain map exists or not debug user-id dump domain-map 1. Verify the location of the domain map on the AD server Server Manager → Tools → ADSI Edit → Connect to → Configuration → Partitions LDAP://CN=Partitions,CN=

27. Slide 27: Troubleshooting username format

    Troubleshooting IP to User mapping ● The username format for Globalprotect and Captive Portal is controlled by the authentication profile ● For issues related to user format through an authentication profile, check the following: ○ User Input ■ All authentication requests start with the string “Tryi

28. Slide 28: Useful CLI commands for troubleshooting

    Troubleshooting IP to User mapping Useful CLI commands for troubleshooting IP to User mapping issues show user ip-user-mapping ip show user ip-user-mapping-mp ip less mp-log useridd.log less mp-log authd.log show user user-attributes user <primary or alternate username> show log userid direction equ

29. Slide 29: Troubleshooting User to Group mapping

    Troubleshooting User to Group mapping ● User to group mapping issues usually happen when the IP to User mapping format does not match the username format in the group which can lead to issues in the following areas: ○ Authentication failures due to user not being in the Allow List ○ Not matching the

30. Slide 30: Troubleshooting User to Group mapping

    Troubleshooting User to Group mapping ● Make sure that the IP to User mapping format matches the User format under the group show user group name <Name of the affected group> show user ip-user-mapping ip <IP address> ● If the user is not showing up in the group, then check on the AD itself and colle

31. Slide 31: Troubleshooting User to Group mapping: outputs needed

    Troubleshooting User to Group mapping Outputs needed for troubleshooting user to group mapping issues authd debugs (From tech support file) debug user-id dump domain-map show user group list show user group-mapping state all show user group name <Name of the affected group> show user user-attributes

32. Slide 32: Questions?

    Questions? © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

33. Slide 33: References and Resources

    References and Resources ● Generating Kerberos keytab for SSO https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boBiCAI ● Configuring Agentless user-id https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClGGCA0 ● All about the domain map https://knowled

34. Slide 34: Thank You

    Thank You paloaltonetworks.com © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

Palo Alto Networks — Technical Presentation (February 2026) on 6ix