Usernames Missing in Traffic Logs After Enabling Panorama User-ID Redistribution

• User-ID redistribution enabled from Panorama

• User-to-IP mapping populates on local firewalls (verified via CLI command >show user ip-user-mapping all)

• Source User column in traffic logs displays only IP addresses instead of usernames

• on-prem firewalls
• Panorama
• User-ID Redistribution

User-ID processing is disabled on the source security zone where user traffic originates. The firewall only maps IP addresses to usernames for traffic originating from zones with User-ID explicitly enabled.

Local Firewall Management:

1. Log into the firewall WebUI.

2. Navigate to Network > Zones.

3. Select the source zone where user traffic originates.

4. Select the Enable User-ID checkbox.

5. Click OK to close the dialog box.

6. Click Commit.

Panorama Management:

1. Log into the Panorama WebUI.

2. Navigate to Network > Zones (or Templates > Network > Zones).

3. Select the template or template stack associated with the local firewall.

4. Select the source zone where user traffic originates.

5. Select the Enable User-ID checkbox.

6. Click OK to close the dialog box.

7. Click Commit and push changes to the target firewall.