Identity Firewall (IDFW) rules fail to match for Mac OS users

Products

• VMware vDefend Firewall
• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

• Identity Firewall (IDFW) rules using Active Directory (AD) groups work correctly for Windows clients but fail for Mac OS clients.
• The IDFW user session does not appear for the Mac OS user under Security > Security Overview > Configuration > Active User Sessions
• Adding the specific IP address of the Mac client to the Distributed Firewall (DFW) rule resolves the issue immediately.

Environment

VMware vDefend Firewall configured with Identity Firewall

VMware NSX

Cause

Event Log Scraping (ELS) in NSX-T/NSX relies on Windows Event ID 4624 (Logon) to map a user's identity to their current IP address. By default, Mac OS clients authenticating against an Active Directory Domain Controller generate a Kerberos TGT request, which results in Event ID 4768 on the Domain Controller. Since NSX ELS does not natively scrape Event 4768, it fails to create a valid IDFW user session for the Mac client's IP address.

Resolution

To resolve this issue, you must force the Mac OS client to generate a Network Logon event (Event ID 4624) that NSX can scrape.

Workaround for Mac OS Clients:

1. Create a Login Script/Item: Configure a login item for Mac users that triggers a connection to a network share on the Domain Controller (e.g., the SYSVOL or NETLOGON share).
2. Mount the Share: Use the mount_smbfs command or the "Connect to Server" feature to authenticate against the share during the user's login sequence.
3. Verify Event Generation: Confirm on the Windows Domain Controller security logs that a successful Event ID 4624 (Logon Type 3) is now generated for the Mac user's IP.

Validation:

• NSX UI: Check Security > Security Overview > Configuration > Active User Sessions to ensure the Mac user's session appears.
• ESXi CLI: On the host running the destination VM, run vsipioctl getfwconfig -f <filter-id> and verify the IDFW rule includes the ext_src_ip addrset containing the Mac client's IP.