topic HA-HA group mappings not passing to secondary PANOS 6.03 in General Topics

HA-HA group mappings not passing to secondary PANOS 6.03

jbabcock — Wed, 25 Jun 2014 15:06:20 GMT

Hello,

I have group mappings present on the Primary Firewall, not passing to the secondary Firewall. Specifically for a new gorup created today. I have tried the various debug refresh commands on both boxes to attempt the get the seocndary box to pull the new group, but no joy. Can anyone suggest what the issue here maybe? As far as the secondary box is concerned it doesn't exist. Which is kind of important as that box is primary for connectivity for a certain subnet that I cannot enforce a policy on based on group membership.

Many thanks

Re: HA-HA group mappings not passing to secondary PANOS 6.03

reaper — Thu, 26 Jun 2014 09:45:11 GMT

did you happen to check the filter in the device tab > user identification > group mapping settings

there could be a filter here that prevents the new group from showing up

regards

Tom

Re: HA-HA group mappings not passing to secondary PANOS 6.03

jbabcock — Thu, 03 Jul 2014 15:56:14 GMT

Hello,

No filter that is relevant to the group in question, it has got worse, we have a new user thats been added in AD, it can be seen on the Primary but not on the Secondary, even after a day. Also the group number enumeration between the two is not the same. Any ideas why the secondary is not synching up with the user-id and group information from the primary?

Re: HA-HA group mappings not passing to secondary PANOS 6.03

pulukas — Thu, 03 Jul 2014 22:18:35 GMT

Does the secondary show correctly connected ip address:

> show user user-id-agent state <your-id-agent-name>

Does a force sync change the status:

> debug user-id refresh group-mapping (Name of group-mapping, or all)

Re: HA-HA group mappings not passing to secondary PANOS 6.03

sjamaluddin — Wed, 09 Jul 2014 18:51:01 GMT

What version of PAN OS are you running on the two HA peers? The new user that was added, was he added to a group called "domain users"?