topic Re: User ID Agent in General Topics

User ID Agent

markk96 — Thu, 16 Oct 2014 17:10:02 GMT

I have a problem where the user id Agent is reporting the wrong user to an IP.

For example, user a is 10.1.1.5 and has id test1

Sometimes user b with an id of test 2 shows up with 10.1.1.5 which is not accurate, if I do a show user Ip mapping it shows test 1 is mapped to 10.1.1.5 and test 2 is mapped to a 10.2.2.5.

These are example IP's.

What is happening user A is being mis identified so blocked applications are allowed throught. If i show session ID on 10.1.1.5 for skype it shows user id test2, but all other Session IDS show test1 as the user.

Re: User ID Agent

bat — Thu, 16 Oct 2014 17:11:40 GMT

markk96

Could you verify if there is any service running on that machine (10.1.1.5) that might be using the login of user test 2 ?

Also check the domain controller eventvwr security logs related to user test2.

Re: User ID Agent

markk96 — Thu, 16 Oct 2014 17:14:33 GMT

I have 24 user id agents deployed in remote agents all reporting back to the firewall.

I only see user ID 2 on the firewall in the skype application traffic that I am trying to block to user ID1.

User ID 1 is in a totally different office location about 400 miles apart than user ID 2. User ID2 has never traveled and gotten an IP address from the User ID office location.

Re: User ID Agent

markk96 — Thu, 16 Oct 2014 17:22:53 GMT

I will also say this is happening to multiple users.

Re: User ID Agent

tshiv — Thu, 16 Oct 2014 23:58:11 GMT

markk96,

Even though the users are in different locations, It could be possible that the machine (10.1.1.5) is a shared resource that can be accessed from multiple locations by many users.

This could explain why the issue might be occurring with multiple users.

Thanks

Re: User ID Agent

markk96 — Fri, 17 Oct 2014 00:24:12 GMT

No that is not the case. Thanks.

Re: User ID Agent

Retired Member — Wed, 29 Oct 2014 19:01:11 GMT

have you fixed the issue ?

how many dc do you have ?

any agents are installed on dc ?

Re: User ID Agent

markk96 — Wed, 29 Oct 2014 19:06:18 GMT

This is a problem with SKYPE and the way the Palo ID's users.

Re: User ID Agent

Retired Member — Wed, 29 Oct 2014 19:17:41 GMT

very interesting, user-id not working properly only for Skype.

better to open a case I think.

Re: User ID Agent

dburns — Wed, 29 Oct 2014 23:47:14 GMT

Controlling Skype

See page 4.

Re: User ID Agent

markk96 — Thu, 30 Oct 2014 01:39:45 GMT

Yes I have seen page 4, skype is using other clients as a proxy via the supernode option. I have a case open with support and not much success, this is why we abandoned the PALO for blocking skype and controlling it with group policy on the ad domain. This works better.