topic Re: User-ID Agent - not populating PAN in General Topics

User-ID Agent - not populating PAN

craymond — Wed, 29 May 2013 17:18:11 GMT

We have been using the User-ID Agent and it has been working for over a year. On the 17th, the PAN stopped populating the traffic log with the user-id information. The Agent is working fine (user ids show up in the monitor) and the PAN is connecting the Agent, but no user information is showing up. I have checked through the config logs, and nothing has been changed besides some reverse NAT rules. There were server updates done at the same time (microsoft security updates) so that could be the issue, but I thought I would throw it out to the community to see if anyone else has had this happen to them recently. I am using ver 4.1.6.

Re: User-ID Agent - not populating PAN

apasupulati — Wed, 29 May 2013 17:39:32 GMT

Hi,

It would help to look at the Uadebug log file in the User-id Directory for any errors.

Also, there are some known issues with UIA version 4.1.6 regarding the ip-mappings being dropped on the firewall.

Thanks,

Aditi

Re: User-ID Agent - not populating PAN

craymond — Wed, 29 May 2013 17:54:35 GMT

I have checked the debug log on the Agent and everything looks fine. What is strange is that everything has been working for over a year.

Re: User-ID Agent - not populating PAN

VinceM — Thu, 30 May 2013 09:33:18 GMT

Hi,

If all info seem to be ok on the agent and be able to see user / IP mapping in then look in the PA: show user ip-user-mapping all

Is there any info ?

No, mean Pan has no user info in memory => either bug in Pan or communication issue between agent and pan

Yes mean mapping is ok. Are you sure that nobody (everybody have a ghost on his network) disable user identification on your Zone ? Rgds

Re: User-ID Agent - not populating PAN

craymond — Mon, 03 Jun 2013 19:15:37 GMT

Just as an update.

I have been in contact with TAC with no joy so far. The PAN sows the userID for a very small fraction of the connections where it used to show the userid for all connections. I have been asked to upgrade to the newest software to see if that resolves the issue.

Re: User-ID Agent - not populating PAN

Nick1 — Thu, 06 Jun 2013 06:01:51 GMT

You might want to triple check that you have all domain controllers listed in the User-ID agent(s). We had our systems admins add a new domain controller without telling the firewall admins and noticed similar strange results. Tech support did not think to check for that but once we added in the new DC everything cleared up.

Re: User-ID Agent - not populating PAN

craymond — Mon, 10 Jun 2013 13:11:50 GMT

Thanks for the reply. I did check that all of the domain controllers were added. I event tried removing the configs for user-id and re-adding them with no success.

Re: User-ID Agent - not populating PAN

statefund — Mon, 10 Jun 2013 13:46:04 GMT

I noticed a similar issue with a newly installed device. Our problem came down to the network Zone not having the "Enable User Identification" flag set. So perhaps double check and make sure that hasn't gotten cleared on any of your network zones?

And what was your output from running show user ip-user-mapping all at the command line?

Re: User-ID Agent - not populating PAN

craymond — Mon, 10 Jun 2013 14:59:31 GMT

We have verified that "Enable User Identification" flag is set for the zones in question (and have disabled and re-enabled them).

show user ip-user-mapping all is blank.

Re: User-ID Agent - not populating PAN

craymond — Wed, 15 Jan 2014 22:57:18 GMT

Worked with TAC. After a FW restart, the User Agent started working again.

Re: User-ID Agent - not populating PAN

Retired Member — Wed, 15 Jan 2014 23:01:33 GMT

That is very interesting.So this means at last we may try restarting FW to solve problems...

Thanks for update.

Re: User-ID Agent - not populating PAN

kirp — Wed, 05 Jan 2022 19:29:41 GMT

If the issue is intermittent restart the management server

debug software restart process management-server