topic Re: Data plane User-ID mappings empty in General Topics

Data plane User-ID mappings empty

SpydersSupport — Fri, 29 May 2015 21:00:53 GMT

We currently have a pair 5020s using LDAP for User-ID - up until about a week ago it was working.

I can see in the logs that the mappings are taking place, and the management plane mappings are there, however the data plane table is empty.

This is causing drops on policies which have User-ID as a stipulation.

Any ideas?

Re: Data plane User-ID mappings empty

pulukas — Fri, 29 May 2015 22:54:15 GMT

I don't see anything on this issue specifically, so here are some general thoughts.

Sounds like a bug. So I would make a quick search of the latest release notes for your PanOS chain and see if this is listed as a solved issue in a release higher than what you are running. If so, then upgrade. If not, open a ticket to get this registered as a bug and into the release chain.

For a quick fix on issues like this a restart of the management plane will sometimes restore service.

debug software restart management-server

Re: Data plane User-ID mappings empty

mivaldi — Fri, 29 May 2015 23:33:51 GMT

What PAN-OS version are you running and what is the Active device's uptime ?

Based on your description, I suspect Bug 64166, resolved in PAN-OS 6.0.4 and 5.0.14.

Re: Data plane User-ID mappings empty

pulukas — Sat, 30 May 2015 13:30:04 GMT

Thanks for doing the bug search and providing the ID.

Re: Data plane User-ID mappings empty

SpydersSupport — Mon, 01 Jun 2015 11:34:44 GMT

Thanks guys, that bug looks exactly like the issue - we're running 6.0.2 with 400 days of update as of this morning.

We'll get'er upgraded and I'll shoot back if it doesn't resolve it but I have a feeling it will.