topic Re: User IP-user-mapping incorrect in General Topics

User IP-user-mapping incorrect

rrau — Fri, 11 Jul 2014 19:01:31 GMT

(PA3000 series FW running 6.0.2) Getting users being blocked by the captive portal from a local service account running on their machine.. only way around it is to disable the service and/or account and then flush the user to ip mapping cache. Any way to eliminate this???? It has been added to the "ignore list" text file on the server running pan agents, however, its a local account so its not working.

Re: User IP-user-mapping incorrect

pulukas — Fri, 11 Jul 2014 21:43:28 GMT

I believe the exclude list for the subnet will do what you want here and ignore this user account.

How the User-ID Agent Include/Exclude List Works

Re: User IP-user-mapping incorrect

rrau — Tue, 15 Jul 2014 18:37:49 GMT

I don't want to exclude an entire subnet.. its happening on all subnets with 1 particular local account.

Re: User IP-user-mapping incorrect

_slv_ — Tue, 15 Jul 2014 20:50:41 GMT

Is this account is used more than one computer? why it's local?

Do You use AD integration or not? in wchich model: agent or agentless?

With regards

Slawek

Re: User IP-user-mapping incorrect

pulukas — Tue, 15 Jul 2014 20:59:07 GMT

Sorry I misunderstood.

This is the document for adding user accounts to the ignore list.

How to Add/Delete Users from Ignore User List using Agentless User-ID

Re: User IP-user-mapping incorrect

rrau — Thu, 17 Jul 2014 13:33:07 GMT

This account is on every computer.. it automatically gets created and is running a particular Citrix service after installing Citrix Receiver (for our Citrix environment)

Re: User IP-user-mapping incorrect

rrau — Thu, 17 Jul 2014 13:33:44 GMT

Yes, we use AD but its a local acct. agentless

Re: User IP-user-mapping incorrect

Wenar — Thu, 17 Jul 2014 13:45:50 GMT

What do you mean with "blocked by captive portal"? The captive portal should only be shown if the user is unknown. If there is already a user mapping the captive portal rule should not match. Even local accounts should be possible to ignore. Is there a user mapping for the ip if the client is blocked?

Re: User IP-user-mapping incorrect

rrau — Thu, 17 Jul 2014 14:44:21 GMT

Web Page Blocked

User: ComputerName\__vmware_user__

URL: www.google.com/

Category: block-list

In accordance with company policies, this website has been blocked.

If access to this site is required for Business Usage, then please submit a support request.

**it is being blocked by a local account that does not have or should not have Internet access**

Re: User IP-user-mapping incorrect

hyadavalli — Thu, 17 Jul 2014 17:47:03 GMT

Hello,

Are you getting user-ip-mapping from user-id agent or from captive portal authentication?

Regards,

Hari Yadavalli

Re: User IP-user-mapping incorrect

rrau — Mon, 11 Aug 2014 15:44:02 GMT

user-id-agent

Re: User IP-user-mapping incorrect

cpainchaud — Wed, 13 Aug 2014 11:58:01 GMT

did you disable WMI/Netbios scanning ? local accounts can only be seen by these means.

Re: User IP-user-mapping incorrect

rrau — Thu, 14 Aug 2014 17:53:49 GMT

WMI probing = Yes

NetBIOS Probing = No

WMI/NetBIOS Probing Interval = 20

Re: User IP-user-mapping incorrect

cpainchaud — Fri, 15 Aug 2014 13:25:48 GMT

turn WMI probing off then.

Re: User IP-user-mapping incorrect

rrau — Mon, 25 Aug 2014 14:48:29 GMT

didnt help