topic Re: IP to user mapping issues with Pan Agent in General Topics

IP to user mapping issues with Pan Agent

hallk — Thu, 27 Jan 2011 09:20:01 GMT

We run McAfee which does some user authentication on AD for group policies. The problem is that when this happens, the ip to user mapping shows this service account as the user instead of the actual user that is logged in. The actual user is then unable to match on a specific rule and therefore gets the incorerct access.

Not sure if changing some timers will help???

Note: Netbios/WMI probing is disabled

Re: IP to user mapping issues with Pan Agent

James — Thu, 27 Jan 2011 13:40:12 GMT

Hi There,

You need to have this user ignored in the User-ID Agent:

https://live.paloaltonetworks.com/docs/DOC-1116

Thanks

James

Re: IP to user mapping issues with Pan Agent

hallk — Mon, 31 Jan 2011 14:21:51 GMT

Thanks James

Is there any command, or something else that you can run, to confirm whether this is working after the file has been created? Should you restart any services?

Re: IP to user mapping issues with Pan Agent

gswcowboy — Mon, 31 Jan 2011 14:25:47 GMT

Just to be on the safe side, you should restart the PAN-Agent service and reset the connection between the PAN device and the PAN-Agent.

> debug device-server reset pan-agent all

Traffic logs lacking the username in question would be indicative of it being resolved.

-Renato