topic Re: Rules applying to wrong users in General Topics

Rules applying to wrong users

cityofkingsland — Wed, 16 Mar 2011 17:35:33 GMT

IOS : 4.0.1

User ID Agent Version: 3.1.2

We have RULE1 set for USERS - A, B, and C. They have an AV, Anti-Spyware, and Vulnerability protection. RULE2 is for ANY other users on the network, which has its own AV, Spyware, Vulnerability profiles as well as a URL Filter.

Users associated with RULE1 will randomly be applied to a URL filter, when they should not be. After a user reboots their computer the problem is fixed, but the problem will happen once again.

I have also tried using Source IP address as well as USERNAME on RULE1 to prevent this, but unfortunitally we still have problems.

Any ideas on other things to try?

Re: Rules applying to wrong users

gswcowboy — Wed, 16 Mar 2011 18:23:51 GMT

Hi,

Please call into Support for a more thorough debugging session.

Re: Rules applying to wrong users

reaper — Thu, 17 Mar 2011 09:06:04 GMT

can you verify the user association via "show user ip-user-mapping ip x.x.x.x"? when a user is experiencing the aforementioned behavior this mapping will probably be -unknown- for his IP address

check the same IP address on the panagent, if it is -unknown- there too, verify the cnfiguration

you may want to increase the age out timeout so user data is stored longer

Re: Rules applying to wrong users

cityofkingsland — Thu, 31 Mar 2011 18:46:35 GMT

show user ip-user-mapping ip 10.7.1.60

IP address: 10.7.1.60
User:        unknown
Ident. By:   Unknown
Idle Timeout: 651s
Max. TTL:    1551s
Groups that user belong to (used in policy)

i have changed the settings on the agent to disable the NetBIOS/WMI checking.

Have reset all other values to defaults. What should i try next?

Thanks for you help!

Re: Rules applying to wrong users

pkruse — Thu, 31 Mar 2011 21:56:00 GMT

Good Afternoon,

More often than not the problems lies with the pan-agent and how it is configured or what it is running on. If you are certain that your pan-agent is installed and functioning properly it would be prudent for you to contact Technical Support at (866) 898-9087.

~Phil

Re: Rules applying to wrong users

cityofkingsland — Mon, 04 Apr 2011 19:09:43 GMT

SOLUTION :When setting up the Agent service on the domain controller you will want to have the settings under the "Recovery" tab to be "Restart the Service" for First/Second/Subsequent failures and to have the restart service timer at 1 minute.

This works for Server 2003 R2 environments.