topic Re: PanAgent AD Groups disappear in General Topics

PanAgent AD Groups disappear

dept_tec_bcn — Fri, 08 Jul 2011 12:34:28 GMT

Hello all,

We have a strange issue.

Suddenly and without any cause the AD users in our PAN device losses the AD groups that they belong to. This is a huge problem cause the security policies configured by groups does not work.

The strange thing is if we force a commit the problem gets temporally solved until in undefined time it happens again.

The PAN agent seems to be working properly. Here I add some tests we made in CLI.

(IP,domain,users and group names had been modified for privacy)

We always get the same answer from this show when it is working and when the problem/issue appears.

admin@FW_VMXXX(active)> show user pan-agent user-IDs

User Name Vsys Groups

------------------------------------------------------------------

domainA\user1 vsys1 DomainA\user-group1

DomainA\user-group2

DomainA\user-group3

DomainA\user-group4

DomainA\user-group5

DomainA\user-group6

domainA\user2 vsys1 DomainA\user-group1

domainA\user3 vsys1 DomainA\user-group4

While we have the problem.

admin@FW_VMXXX(active)> show user ip-user-mapping ip 192.168.x.x

IP address: 192.168.x.x

User: domainA\user1

Ident. By: AD

Idle Timeout: 2608s

Max. TTL: 2608s

Groups that user belong to (used in policy)

While is working properly we get:

IP address: 192.168.x.x

User: domainA\user1

Ident. By: AD

Idle Timeout: 2366s

Max. TTL: 2366s

Groups that user belong to (used in policy)

Group(s): DomainA\user-group1

DomainA\user-group2

DomainA\user-group3

DomainA\user-group4

DomainA\user-group5

DomainA\user-group6

Many thanks in advance.

Albert

Re: PanAgent AD Groups disappear

bpappas — Fri, 08 Jul 2011 15:54:34 GMT

What version of PANOS are you running on the device?

Re: PanAgent AD Groups disappear

dept_tec_bcn — Mon, 11 Jul 2011 08:15:42 GMT

We are running 4.0.1

Re: PanAgent AD Groups disappear

reaper — Mon, 11 Jul 2011 12:49:22 GMT

Hi Albert

It's best to upgrade to 4.0.3 as soon as possible as 4.0.1 did have some issues with userID matching security policies, these issues were addressed in 4.0.3

regards

Tom

Re: PanAgent AD Groups disappear

pflanagan — Wed, 24 Aug 2011 15:38:26 GMT

We ran into this problem on 4.0.4. Any ideas?

Re: PanAgent AD Groups disappear

friento — Wed, 24 Aug 2011 16:17:03 GMT

Thought this issue is fix with version 4.03. I hope it did not re-surface with version 4.04.

Part of version 4.03 released note.

[28873] An inconsistency in the user and group mapping database can occur.

Re: PanAgent AD Groups disappear

migration — Mon, 16 Jan 2012 13:48:15 GMT

We are experiencing this same issue in 4.1.1

Re: PanAgent AD Groups disappear

fnichelson — Wed, 18 Jan 2012 17:57:29 GMT

We had this happen also, we run two different domains in the same forest. We had found that if they had a drive mapping to the other domain, when authentication took place it confused the pan agent and assigned them to a different AD group. Once those drive mappings had been removed and the user logged off and back on the problem went away.