topic Re: PAN agent Group cache on PAN in General Topics

PAN agent Group cache on PAN

helenio.sartori — Tue, 15 Jun 2010 15:58:55 GMT

Hello, I'm using PAN OS 3.0.5 and doing

> debug device-server dump user-group name

followed b the tab I'm seing very old group that are not anymore in the Filter group member of the pan-agent. It seams that the PAN have cached the olds user/group relation. There is the way to force a clear of the group <-> user relation on the PAN FW ?

Re: PAN agent Group cache on PAN

swhyte — Fri, 18 Jun 2010 22:41:15 GMT

You can clear the cache for this information with the following commands:

> debug dataplane reset user-cache
> all Reset all ip to user cache in data plane
> ip Reset the specified ip to user cache in data plane

thanks,

Stephen

Re: PAN agent Group cache on PAN

helenio.sartori — Mon, 21 Jun 2010 09:31:02 GMT

The command above seams the delete only ip <-> user mapping.

I'd like to delete user <-> group mapping that seams to be still on chache cause I see very old group that I'm not using since month.

command -> debug device-server dump user-group name

Re: PAN agent Group cache on PAN

James — Mon, 21 Jun 2010 21:05:57 GMT

The "Stale" content could be coming from the UIA. You can check this by looking at the cache files in the UIA Installation Directory - typically under "Program Files".

Regards

James

Re: PAN agent Group cache on PAN

lwheelock — Fri, 11 May 2012 21:38:01 GMT

What about on 4.x.x versions where the group information comes from the Firewall itself?

Re: PAN agent Group cache on PAN

jseals — Sat, 12 May 2012 06:24:29 GMT

You can clear the group cache on 4.1.x by doing the following:

> debug user-id clear group all

You can then force a group refresh:

> debug user-id refresh group-mapping all

-Jason

Re: PAN agent Group cache on PAN

lwheelock — Mon, 14 May 2012 17:43:51 GMT

Thank you, that was what I needed.

Re: PAN agent Group cache on PAN

forfarj — Wed, 13 Jun 2012 12:49:18 GMT

Exactly the answer I was looking for to address my issue. I had duplicated groups listed from the PANuserAgent after installing the new USERIDagent and it was causing issues with classification. Clearing out the groups and refreshing them fixed the issue.

Justin