topic Re: Force HIP Check for a failing users in GlobalProtect Discussions

Force HIP Check for a failing users

akawilson — Fri, 08 Oct 2021 14:08:33 GMT

I have all my HIP Obj and Profiles built and I have a few users who are matching on not "match domain" but there domain is correct on the PC when we check. Everyone else is matching correctly.

When I run the debug user-id dump hip report it shows the domain as incorrect under host-info from CLI; <domain>xxx.xxxxx.com</domain>. Is there a way to clear the host info on the Palo Firewall so it pulls fresh host-info from the client. Would be nice to do this without needing to ask the user to do it from the GP Client.

can you just delete the pan_gp_hrpt.xml file?

Thank you,

Kevin

Re: Force HIP Check for a failing users

nikoolayy1 — Sun, 17 Oct 2021 12:06:12 GMT

Because the HIP data is related to a user have you tried to clear the user cache:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClshCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm9fCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clq8CAC

Re: Force HIP Check for a failing users

akawilson — Thu, 21 Oct 2021 13:18:36 GMT

I have not tried clearing cache I will try this and let you know.

Re: Force HIP Check for a failing users

nikoolayy1 — Sun, 31 Oct 2021 18:08:43 GMT

Did the cache clearing help with the HIP check ?