An application is blocked for the right employee, but the Palo Alto firewall log shows a different username. Before changing the Security policy, answer a narrower question: which identity source associated this connection with that user, and was an IP address alone enough to identify them?
This guide provides a User-ID troubleshooting matrix, a read-only evidence workflow and a change-acceptance checklist. It focuses on incorrect or missing IP-to-user mappings, including the shared-IP case on terminal servers. All examples are hypothetical; commands are templates, not results from a production firewall.
