Identity Firewall (IDFW) with Event Log Scraping (ELS) Not Working Consistently

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

• Identity Distributed Firewall (IDFW) rules utilizing Event Log Scraping (ELS) apply inconsistently to end-user traffic.
• When verifying the IDFW User Sessions table (Security > Security Overview > Configuration > Active User Sessions), expected user sessions are missing intermittently.
• The Active Directory (AD) configuration in the IDFW environment correctly includes all target Event Log servers/Domain Controllers.

Environment

VMware vDefend Firewall

VMware NSX

Cause

IDFW Event Log Scraping relies heavily on Event ID 4624 (Logon Type 3 - Network) being generated on the Domain Controller (DC) to map a user's identity to their current IP address.

More information on Event ID 4624

If a user logs into a workstation while the DC is unreachable, Windows authenticates the user using cached credentials. Because this occurs locally on the endpoint:

• No Event ID 4624 (Type 3) is generated on the DC at the time of logon.
• IDFW has no log to scrape, resulting in a failure to map the user session.

This behavior is most frequently observed in two scenarios:

• Remote/VPN Users: The user logs into Windows before establishing a VPN connection, meaning the DC is entirely unreachable during the initial logon phase.
• Workstations experiencing network connectivity issues at the time of logon.

Resolution

To resolve this, a Network Logon event can be forced to the DC. A reliable way of achieving this is by mounting the SYSVOL share. 

 

Manual Workaround

1. Open the Windows Run prompt (Win + R).
2. Type the following path and press Enter:
   1. \\YourDomain.local\sysvol
   2. Replace YourDomain.local with your actual Active Directory Domain Name
3. Once the share opens, check the IDFW User Sessions table to confirm the user session has populated. IDFW rules should now work as expected. 

 

Automated Workaround for VPN Users

Some VPN solutions provide features to automatically execute scripts immediately after a VPN tunnel is established.

 

 

Example

Palo Alto Networks GlobalProtect supports post-connection script execution via Windows Registry configuration. For implementation details, see Deploy Scripts Using the Windows Registry

 

You can deploy the following batch script to automate the SYSVOL connection in the background upon successful VPN connection. This script connects sysvol to drive Z: and then disconnects it again 3 seconds later

 

@echo off

:: Temporarily map and open SYSVOL in the background
net use Z: \\YOUR_DOMAIN.local\SYSVOL
start /min "" explorer.exe Z:

:: Wait for 3 seconds
timeout /t 3 /nobreak >nul

:: Unmount drive Z:
net use Z: /delete /y

 

You can modify the drive letter if Z: conflicts with existing drives.