Double running Pan Agent - Precedence

MGoodnow — Wed, 30 Jun 2010 19:46:05 GMT

Hello,

We have Pan Agents running on 2 servers - querying against the same list of AD controllers. Is there a precedence that the PAN devices will utilize if the Pan Agent logs have 2 entries for the same IP - but not the same user - or none?

For instance one Pan agent has a listing of "192.168.1.10 to _unknown_" and the second Pan Agent has "192.168.1.10 to domain\me". Which would take precedence as the logged in user?

We are having this inconsistance because we have Netbios scanning disabled (services are disabled on our image). I understand how this is happening (a small handful of users do not log directly into the domain - so we get some inconsistancies since Netbios is not checking). However, it appears last known actual domain "user" login wins over "_unknown_". Is that a true statement?

Thanks so much.

Mike

Re: Double running Pan Agent - Precedence

swhyte — Thu, 01 Jul 2010 22:12:04 GMT

Hello Mike,

in a nutshell which ever pan agent has the event will win.

So, if the pan device asks each pan agent for the user of the same ip, the pan agent that answers last will win.

thanks,

Stephen

topic Re: Double running Pan Agent - Precedence in General Topics

Double running Pan Agent - Precedence

Re: Double running Pan Agent - Precedence