SSE-ENGINEER · Question #14
A user connected to Prisma Access reports that traffic intermittently is denied after matching a Catch-All Deny rule at the bottom and bypassing HIP-based policies. Refreshing VPN connection…
The correct answer is B. User mapping is learned from sources other than gateway authentication. C. Firewall loses user mapping due to missed HIP report checks. User mapping learned from sources other than gateway authentication can cause intermittent access issues if it conflicts with the expected user identity used in HIP-based policies. If the firewall is associating the user with an outdated or incorrect mapping, traffic may not…
Question
A user connected to Prisma Access reports that traffic intermittently is denied after matching a Catch-All Deny rule at the bottom and bypassing HIP-based policies. Refreshing VPN connection restores the access. What are two reasons for this behavior? (Choose two.)
Options
- A"Collect HIP data' needs to be enabled in the configuration.
- BUser mapping is learned from sources other than gateway authentication.
- CFirewall loses user mapping due to missed HIP report checks.
- DHIP-enforced policy is scheduled for certain hours of the day.
How the community answered
(45 responses)- A11% (5)
- B69% (31)
- D20% (9)
Explanation
User mapping learned from sources other than gateway authentication can cause intermittent access issues if it conflicts with the expected user identity used in HIP-based policies. If the firewall is associating the user with an outdated or incorrect mapping, traffic may not match the intended security policies, leading to denials by the Catch-All Deny rule. If the firewall loses user mapping due to missed HIP report checks, the user may temporarily lose access to policies that require a valid Host Information Profile (HIP) match. When the VPN connection is refreshed, the HIP check is re-initiated, restoring access until the issue repeats.
Topics
Community Discussion
No community discussion yet for this question.