topic Re: Agentless User ID problems with IPv6 in General Topics

Agentless User ID problems with IPv6

rlawsha — Wed, 30 Jul 2014 23:52:19 GMT

We are using an agentless user id system with four domain controllers. IPv4 and IPv6 is used inside and outside our organization. The PA box fails to identify users that run IPv6. Turning off IPv6 on the Windows clients fixes the problem. The problem is intermittent so it is hard to track down. Running 6.0.3 software.

Re: Agentless User ID problems with IPv6

pulukas — Thu, 31 Jul 2014 00:15:07 GMT

Do you have ipv6 enabled and configured on the Palo Alto?

Have a look at the checklist for ipv6 usage here.

How to Check IPV6 Traffic Routing

Re: Agentless User ID problems with IPv6

rlawsha — Thu, 07 Aug 2014 12:21:12 GMT

I checked the 6 steps in the article you provided:

1 - make sure ipv6 is enabled - okay

2 - check ipv6 default route - okay

3 - ping via ipv6 from workstation to firewall internal interface, host name and IP address - okay

4 - ping via ipv6 from firewall external interface to external host - NOT OKAY

5 - ping via ipv6 from firewall internal interface to external host - okay

So this is weird, workstations have no trouble with ipv6, they can visit sites, ping sites and all that. The problem is, agentless user-id is inconsistent with ipv6 clients. Not sure why step 4 from above will not work.

Re: Agentless User ID problems with IPv6

rlawsha — Thu, 07 Aug 2014 18:59:25 GMT

The problem seems to be caused when a workstation has multiple ipv6 temp addresses. To test this I did this on my workstation:

netsh interface ipv6 set global randomizeidentifiers=disabled

netsh interface ipv6 set privacy state=disabled

reboot

Now the PA box correctly identifies me

I will have to test this long term but so far it has worked for me

Re: Agentless User ID problems with IPv6

pulukas — Thu, 07 Aug 2014 19:21:12 GMT

Thanks for posting the solution. An obscure issue for sure.