topic Re: User-ID for DNS in General Topics

User-ID for DNS

sunspersons — Tue, 14 Apr 2015 16:17:42 GMT

We have a server that has no body logged into it and all the DNS traffic from that server is showing as a certain user sending the traffic. Is there anyway to exclude this server from User-ID or another way to remove the user from this traffic?

Re: User-ID for DNS

_slv_ — Tue, 14 Apr 2015 18:32:10 GMT

Hi senspersons

I guess that this is Windows server with some service running with user account. In the example it is "scott".

You can tell the User-ID Agent to ignore that particular user account. To do this, create a file called “ignore_user_list.txt” in the directory in

which the User-ID Agent was installed (typically c:\Program Files\Palo Alto Networks\PanAgent). Put in that file the name of the service account that you want the User-ID Agent to ignore.

the ignore_user_list.txt file requires one user name per line with no domain preprend.

e.g.

joesmith

janedoe

administrator

av-admin

Also, you may want to clear the user cache via the CLI.

admin@PA-2050> clear user-cache
> all Clear all ip to user cache in data plane
> ip Clear the specified ip to user cache in data plane

Regards

Slawek

Re: User-ID for DNS

rsingh — Tue, 14 Apr 2015 20:30:32 GMT

Kindly go through the following docs,

How to Ignore Users in User-ID Agent

https://live.paloaltonetworks.com/docs/DOC-2893

How to Add/Delete Users from Ignore User List using Agentless User-ID

https://live.paloaltonetworks.com/docs/DOC-4278

How to Clear User-to-IP Mapping for an Ignored User and Verify it is Working

https://live.paloaltonetworks.com/docs/DOC-6107

Regards,

Rahul

Re: User-ID for DNS

sunspersons — Tue, 14 Apr 2015 22:02:25 GMT

Thank you, that was exactly what I was looking for.

I ran these commands -

clear user-cache ip 10.0.36.15

clear user-cache all

clear user-cache-mp ip 10.0.36.15

clear user-cache-mp all

And when I run show user ip-user-mapping ip 10.0.36.15 it still shows the user being mapped to that system -

IP address: 10.0.36.15 (vsys1)

User: xxxxx\xscott

From: UIA

Idle Timeout: 1552s

Max. TTL: 1552s

Groups that the user belongs to (used in policy)

Group(s): cn=xxxx,ou=paloalto,ou=groups,ou=xxxxxx,dc=xxxxx,dc=local

Any ideas why the user isn't being cleared from that machine?

Thanks,

Sean

Re: User-ID for DNS

_slv_ — Wed, 15 Apr 2015 08:17:11 GMT

Did You create a file called “ignore_user_list.txt” in the directory inwhich the User-ID Agent was installed with "xscott" inside?

Regards

Slawek

Re: User-ID for DNS

rsingh — Wed, 15 Apr 2015 11:57:38 GMT

Also, make sure you following command first to clear the mapping from MP,

clear user-cache-mp all

Then run,

clear user-cache all

DP learns the mapping from MP. Sometimes, if you clear DP first, and before you clear MP, it will be pushed again from MP to DP. So it is always better to clear from MP, then from DP.

Regards,

Rahul Singh

Re: User-ID for DNS

sunspersons — Wed, 15 Apr 2015 20:41:36 GMT

I have added the ignore_user_list.txt into the User-ID Agent folder and have the user both with and without the domain prepended. domain\username and username on separate lines. I also ran the clear user-cache-mp all command first then the clear user-cache all. When I run show user ip-user-mapping ip 10.0.36.15, it still shows the user. Not sure whats going on but it doesn't want to clear the user out from the machine... Any ideas on something else I can try?

Thanks,

Sean

Re: User-ID for DNS

rsingh — Wed, 15 Apr 2015 20:51:02 GMT

You need to clear the user from User-ID agent first.

User-ID Agent >>> Monitoring >>> Discovered Users,

Look for the user and delete it.

Then delete MP cache and DP cache.

Regards,

Rahul Singh

Re: User-ID for DNS

sunspersons — Wed, 15 Apr 2015 20:55:36 GMT

I just tried clearing it from the User-ID Agent and the name came back within roughly 5 seconds. At this point I'm beginning to think its a bug of some sort... Why does the computer/agent think that user is logged into the 10.0.36.15 machine when no body is?

Re: User-ID for DNS

rsingh — Wed, 15 Apr 2015 20:58:12 GMT

Can you check if WMI probing is enabled on User ID Agent? If it is enabled, disable it.

Re: User-ID for DNS

rsingh — Wed, 15 Apr 2015 21:02:57 GMT

Make sure you disable the service first, make the changes, commit, start the service.

Re: User-ID for DNS

rsingh — Wed, 15 Apr 2015 21:04:17 GMT

One more thing, make sure you have created the file with proper extension.

It should not be the ignore_user_list.txt.txt

Make sure you uncheck the option "Hide extensions" under windows folder options

Re: User-ID for DNS

sunspersons — Wed, 15 Apr 2015 21:11:29 GMT

That seems to have fixed it. After I disabled WMI probing, and cleared the cache the user is no longer listed for DNS traffic.

Is there a way to ignore that particular machine from ever reporting a user? I'd still like to see the user's traffic, just not for that machine... No sure how to go about that...

Re: User-ID for DNS

rsingh — Wed, 15 Apr 2015 21:23:16 GMT

you can try to exclude that PC's IP under User ID Agent >>> Discovery >>> Include/Exclude Networks.

Add Exclude Specified Network >>> configure the PC IP addr with /32 mask.

Check if that works.

Regards,

Rahul Singh

Re: User-ID for DNS

sunspersons — Thu, 16 Apr 2015 15:34:04 GMT

The agent accepted the /32 however the user is showing up in the traffic log for DNS again.

Re: User-ID for DNS

rsingh — Thu, 16 Apr 2015 15:42:14 GMT

Is it still showing the user ip mapping on the FW?

Re: User-ID for DNS

sunspersons — Thu, 16 Apr 2015 16:56:16 GMT

Its working properly now!! Thanks again for your patience. After added the /32 for exclude and clearing the cache several times the logging is showing up exactly how I want it.

Re: User-ID for DNS

rsingh — Thu, 16 Apr 2015 16:59:25 GMT

You are most welcome

Regards,

Rahul Singh