topic Re: Connect Server Monitor Failure Logs repetition in Next-Generation Firewall Discussions

Connect Server Monitor Failure Logs repetition

SoftMochi — Wed, 24 Aug 2022 12:59:12 GMT

Hello Guys.

Good day.

I've found about User-ID logs.

these logs are occurring from now.

How can I solve this problem ?

Should I Check AD DC Server ?

(Luckily, There are no CPU Load, Network Latency)

nikoolayy1 — Wed, 31 Aug 2022 09:24:14 GMT

Palo Alto uses WMI for resolve user names with the AD and LDAP for getting the AD groups after the username is resolved. Test the WMI:

Also enable debugging of the user id to see more usefull info and do some ping tests to the AD controller to see the latency and packet loss and select with ping the correct source ip address that the service route for the User-ID agents uses https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/virtual-systems/customize-service-routes-for-a-virtual-system#id12679d38-2027-4bc8-9e72-f366977b721e_id1747IF001QC

If you also have issues with the LDAP see link below:

As a workaround till the issue is resolved you try client probing or get the user id with redistribution:

SoftMochi — Mon, 05 Sep 2022 05:54:43 GMT

Thanks.

I will try those.

nikoolayy1 — Thu, 13 Oct 2022 21:20:51 GMT

If you managed to get the needed answers, please flag the question as answered.

SoftMochi — Fri, 14 Oct 2022 00:59:45 GMT

Sorry, I just done it