topic Re: UserID present on Agent but not Palo Firewall in General Topics

UserID present on Agent but not Palo Firewall

apackard — Mon, 28 May 2012 17:13:18 GMT

Does anyone know under what conditions a Palo firewall will not be tracking a user ID, when said ID is being tracked by a Palo agent that is active and operational?

I have had experience of the agents themselves losing an ID for various reasons, but currently I have a scenario where a user is being prompted via a Captive Portal (a console session validates that the PA does not have a map for their PC), yet the Palo agent does have a valid record for that user at that IP address.

Re: UserID present on Agent but not Palo Firewall

apackard — Mon, 28 May 2012 17:14:23 GMT

Note: Should add that the IP range is not being filtered, and we have other valid maps on the same subnet.

Re: UserID present on Agent but not Palo Firewall

sspringer — Fri, 01 Jun 2012 23:00:43 GMT

Hello,

Captive Portal should only be prompted for user's that do not have an active ip-user-mapping.

Did you confirm the user-id-agent has the ip mapping for the user?

Did you check the mapping via CLI on the device?

> show user ip-user-mapping ip <ip address>

It would be strange behavior for a user with a mapping to receive a Captive Portal prompt. I would recommend contacting your support team so we can perform some live debugging on the device.

- Stefan

Re: UserID present on Agent but not Palo Firewall

apackard — Sat, 02 Jun 2012 11:14:07 GMT

Stefan,

That is the issue - the agent *does* have a mapping, but the PA itself does not pick it up (even though it does for the other 500 odd accounts being tracked). It is transient issue, so its not the host IP, or the account itself, it just sometimes doesn't get reflected accurately.

Will prob have to raise an official support call, but was looking for any hints first in case there are known scenarios when this may happen.

Rgds

Re: UserID present on Agent but not Palo Firewall

sspringer — Tue, 19 Jun 2012 19:07:10 GMT

Is WMI or NetBIOS probing enabled?

Here is excerpt from User Identification Tech Note: https://live.paloaltonetworks.com/docs/DOC-3120

"If the probe succeeds and then subsequently fails for the same host, the IP will be re-classified as unknown."

If enabled, you may want to disable for testing.

It doesn't sound like a timeout issue, but you can enable 'Open Server Sessions' to see if that helps the problem.

- Stefan