Hello friends, welcome to Day 36 of my PCNS Palo Alto Firewall training series. In this session I take the User-ID concept one step further and I do everything in a real lab, so you can clearly understand the flow end-to-end. First, I explain the topology: a domain-joined Windows client, a Windows Server acting as AD/DNS, and the Palo Alto firewall. The key idea is simple—when a user logs in, the Windows server generates the login event, that information is shared to Palo Alto, and the firewall builds the IP-to-username/group mapping table. Then whenever traffic comes, Palo Alto checks the mapping table, matches the user/group, and applies the correct security policy. After that I configure Windows Server 2008 for Active Directory (new forest test.com), create an “Palo Alto” service account, and give it the required permissions/groups (like Event Log Reader, Admin, Server Operator, DCOM) plus WMI permissions (Remote Enable, Read Security, Edit Security). On the firewall side, I configure interfaces/zones, fix the Service Route (because AD is reachable via ethernet1/1, not mgmt), build the LDAP server profile (Base DN dc=test,dc=com and bind user), and enable User-ID on the inside zone. Finally, I verify everything: I confirm the login event on the server, check the firewall mapping table using CLI, and test browsing (Facebook/Google) to confirm traffic hits the correct user-based policy.