topic USER-ID XML API Include Network in Automation/API Discussions

USER-ID XML API Include Network

rats — Thu, 24 Feb 2022 14:39:14 GMT

Hi,

I'm using two PA-850 in HA, Software Version 8.1.21

For our Wifi, we have a Clearpass server sending XML-API commands to our PaloAlto, to do IP/User Mapping, but the mapping doesn't work.

If I try to call the API directly (using https://myfirewall.com/api), I can send commands this way, and see the result.

Sending In API-> User-id this xml command, to login :

<uid-message>
<version>2.0</version>
<type>update</type>
<payload>
<login>
<entry name="MyDomain\user" ip="10.0.1.1" timeout="0"/>
</login>
</payload>
</uid-message>

I get this Error in return :

While This IP is clearly in a Zone where User-Id is enabled.

For a user already logged (by ActiveDirectory, via the User Agent)
If I try a Logout command :

<uid-message>
<version>2.0</version>
<type>update</type>
<payload>
<logout>
<entry name="MyDomain\User" ip="10.0.1.12"/>
</logout>
</payload>
</uid-message>

No problem, I get this answer :

So, did I miss something in my settings, or could this be a bug ?
And If so, should I update to a latest version ?

Thanks by advance for your answers.

Michael

Re: USER-ID XML API Include Network

JimmyHolland — Thu, 24 Feb 2022 14:50:59 GMT

Hi @rats, the error refers to the "include network" and says 10.0.1.1 is not within this network. How is your include/exclude configured at the moment?

Re: USER-ID XML API Include Network

rats — Thu, 24 Feb 2022 15:25:33 GMT

Hi Jimmy,

Thanks for your response.

I have only a subnetwork In exclude mode, nothing else.

Re: USER-ID XML API Include Network

JimmyHolland — Thu, 24 Feb 2022 16:06:12 GMT

Hi @rats, if the IP address you are trying to register is outside of the exclude network(s), and/or inside of the include networks, as defined in the User-ID settings and the zone settings too (they also have include/exclude configuration) then this is not expected behaviour. I would suggest raising a case/ticket to have this investigated further, as sharing more details of your specific configuration in a public forum is not advised.

Re: USER-ID XML API Include Network

rats — Fri, 25 Feb 2022 07:27:10 GMT

Hi Jimmy,

I'll raise a ticket for this issue, thanks the answers.

Michael