topic User ID agents showing as red in General Topics

User ID agents showing as red

nthen — Wed, 05 Jun 2013 14:37:46 GMT

I have 3 separate domains on my network and they are not trusted together. On my main domain where the firewall is installed the agent shows green, however when I install the agent under the remote domains (on different subnets across the country) the icon is red. The settings match my 2 main domain controllers that are working. When I look at the remote DCs they are reading the log files. Also port 5007 is reachable from the outside. Any thoughts on why they aren't connecting? I am not seeing any details as to why.

Re: User ID agents showing as red

VinceM — Wed, 05 Jun 2013 14:51:29 GMT

Hi,

Try to configure different port for each agent on your palo

AD1 - port 5007

AD2 - port 5008

AD3 - port 5009

and of course be sure that your palo is able to contact each of your agent 🙂 through the management interface by default

Should solve your issue

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 14:54:03 GMT

I am using the Windows agent (not the one on the PAN) are you suggesting that I change the port on my remote DCs?

Re: User ID agents showing as red

VinceM — Wed, 05 Jun 2013 14:56:22 GMT

Hi,

no, just in both palo (device / User Identification / User-IDAgent) and on each agent, just the comunication port. No change on the AD

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 14:59:38 GMT

I have the agents running on my remote domain controllers. I changed to port 5008 on a remote domain controller (where the agent is running) and to 5008 on the PAN. Still showing red.

Re: User ID agents showing as red

VinceM — Wed, 05 Jun 2013 15:09:02 GMT

sure that communication on port 5008 is possible from management interface on the palo and your remote AD ?

No FW on the AD ?

Which Pa model ?

Which version on the PA ?

Which version on the agent ?

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 15:12:22 GMT

I can ping between management interface and remote DCs and open a telnet session to the remote agent ports. I am running a 3020 with version 5.0.5. Also the agent is the latest 5.0.4-5

Re: User ID agents showing as red

VinceM — Wed, 05 Jun 2013 15:21:34 GMT

Please run

show user user-id-agent state Name-Agent

show user user-id-agent statistics

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 15:27:09 GMT

Host: 172.16.109.2:5009

Status: not-conn:idle(Error: Failed to connect to User-ID-Agent at 172.16.109.2(172.16.109.2):5009)

num of connection tried : 75

num of connection succeeded : 0

num of connection failed : 75

REMOTESVR1 172.16.109.2 5009 vsys1 not-conn:Connecting 0

Re: User ID agents showing as red

VinceM — Wed, 05 Jun 2013 15:45:50 GMT

Either something is blocked between manegemnt and remote agent (something in logs ?) or it's a bug then contact your local SE.

Re: User ID agents showing as red

Retired Member — Wed, 05 Jun 2013 17:11:03 GMT

do you have a security rule for your management ip ?

since they are not trusted try to add a rule for management at top (if you don't have)

and see what you see in monitor logs for destination ip filter address of 2 agents seperately

Do you have any service route configuration ? also check if you are using management port for everything or not ?

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 18:45:59 GMT

I do not have any security rules currently for my management IP. All user-id agents are coming from the Inside trusted zone. I am noticing that the PAN is dropping traffic for these when running a packet capture. When I configure the service route for user-id agent traffic and use my LAN interface instead of management all agents are working and connect. I am not sure where the PAN is dropping traffic however.

Re: User ID agents showing as red

Retired Member — Wed, 05 Jun 2013 18:50:13 GMT

so write a rule for management ip

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 18:52:55 GMT

I'll try this, but what zone would I use for the management IP?

Re: User ID agents showing as red

Retired Member — Wed, 05 Jun 2013 18:56:51 GMT

if it's default gateway is in LAN zone then it'll be LAN zone.You can write any any with source ip only.

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 19:01:27 GMT

My Management ip and default gw are on a completely different subnet than my LAN on eth1/2 will this matter?

Re: User ID agents showing as red

Retired Member — Wed, 05 Jun 2013 19:05:08 GMT

why don't you use default gateway as eht1/2 ip ? I think you can.

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 19:26:45 GMT

All of our network management is on a separate subnet such as firewall, switches, etc... we do not put the management on the same as the LAN typically. Is this what is causing the issue perhaps? 2 of my domain controllers are on the same subnet as the LAN interface and those work without issue even through the traffic goes out the management interface. It just affects the remote DCs.

Re: User ID agents showing as red

Retired Member — Wed, 05 Jun 2013 19:31:55 GMT

So try to write 2 route for these 2 ip address forward them to eth1/2

you'll write these routes to management route table(service route) not virtual router

Re: User ID agents showing as red

nthen — Wed, 05 Jun 2013 19:34:08 GMT

So I have a better understanding of how the firewall works, is the behavior that i am seeing by design where subnets somewhere down the line do not directly work like I am experiencing?