User-ID basics
In this section, we will learn how to set up the basics needed to identify users by preparing AD and configuring the agent/agentless configuration to collect user-to-IP mappings.
One universal truth is that for User-ID to work, the interface that receives connections from the users that need to be identified needs to have User-ID enabled in its zone. Navigate to Network | Zones and click Enable User Identification in the appropriate zone, as you can see in the following screenshot:
Figure 6.1: User-ID in a zone
This setting needs to be active in local zones, or remote zones (such as VPNs) that receive user sessions, but should not be enabled for untrusted zones such as internet uplinks. For each source IP in a User-ID-enabled zone, the firewall will try to create a record for user-to-IP mapping. If User-ID is enabled in an outside-facing zone, the available table space may get flooded with empty (random internet background noise) user-to-IP mappings...
