UserID mapping flags user unknown with single digit timeout secs

rshetye — Mon, 17 Mar 2025 03:51:03 GMT

Hi all,

I'm using Agentless UserID mapping. Since past 2 weeks, random users are dropped out of ip-user-mapping and unable to browse internet.

When I run "show user ip-user-mapping all" on CLI:

I get 90% of connected AD users mapped to IP addresses but rest of the 10% users are logged as below -

192.168.2.27 | vsys1 | AD | unknown unknown | 1 | 4

I verified that the subnet is included, clocks are synced with correct NTP, LDAP & Kerberos server works fine. Server-Monitor are "Connected" and below when run "show user server-monitor state all" -

UDP Syslog Listener Service is disabled
SSL Syslog Listener Service is disabled

Server: <server1.domain.com> (vsys: vsys1) (job 4132013)
Host: 192.168.0.31
num of log query made : 15272
num of log query failed : 144
num of log read : 478509
last record timestamp : 1742182760
last record time : 20250317033920.0-000

Server: <server2.domain.com>(vsys: vsys1) (job 4132059)
Host: 192.168.0.41
num of log query made : 28536
num of log query failed : 144
num of log read : 0
last record timestamp : 0
last record time :

I can see the successful User Logon events (event ID 4624) on the AD server for that specific IP address and device. Since they can access local resources and file server I don't think AD has any issues authenticating the users. Should I be looking for any specific flag that could cause the delay?

The VPN/GloalProtect connects these same users seamlessly but it is disrupting the business tasks on corporate network.

Any response or tip is highly appreciated, since Level-2/3 Support Engineer is also unable to help me on this one.

Re: UserID mapping flags user unknown with single digit timeout secs

Edsnow — Tue, 18 Mar 2025 03:58:44 GMT

If you are using agentless User id, you can change the timeout value from the user ID setting in the firewall.

topic Re: UserID mapping flags user unknown with single digit timeout secs in Next-Generation Firewall Discussions

UserID mapping flags user unknown with single digit timeout secs

Re: UserID mapping flags user unknown with single digit timeout secs