Hello friends, welcome back—this is Day 35 of my PCNSA series. In this session I explained User-ID in Palo Alto Firewall: what it is, why we need it, and how it gives you more granular control compared to old-style IP-based policies. I used a simple “building with multiple floors” example to show the real problem: when a user moves around (or works from home), the IP keeps changing, so policies based only on IP don’t really represent the actual user. With User-ID, I can match traffic to the actual username/user group and enforce access consistently. Then I connected User-ID with Windows Server/Active Directory, because to understand User-ID you must understand where the user information comes from. I walked through the traffic flow: when a user logs into a domain PC, the PC sends login details (username + IP) to the Windows server. An agent reads those logs and shares the mapping with the Palo Alto firewall, so the firewall builds a table of IP-to-username (and group). When traffic hits the firewall, it looks up the source IP, finds the username, checks the user/group-based policy, and then allows or blocks. I also clarified why username is not carried in normal OSI layers—sending it in every packet would be risky—so this mapping approach is how it works in real environments.