topic Re: No result from "show user pan-agent user-IDs" command in General Topics

No result from "show user pan-agent user-IDs" command

systemadmin_tu — Mon, 19 Sep 2011 13:25:14 GMT

Dear All,

I just install pan-agent on my AD, windwos 2003 server, and configure PAN box to connect to this pan-agent. I can see traffic with user from AD server. I found result from command " show user ip-user-mapping all". I can list group of AD with command " debug device-server dump user-group name".

However after I run command "show user pan-agent user-IDs", it didn't return result. I found some misstake. I cann't control application usage with group name from AD on security policy. Moreover, after I add user on AD, PAN box didn't update list of new user from AD.

Thanks you,

Re: No result from "show user pan-agent user-IDs" command

jleung — Mon, 19 Sep 2011 14:15:42 GMT

Hi,

Have you tried to click Get all from the first page of the PAN agent console? Can you see any user to IP mapping there? How many domain controllers do you have? Have you put all the domain controllers on the list which is mandatory? Are you running the agent with privilege to read AD security log?

Re: No result from "show user pan-agent user-IDs" command

systemadmin_tu — Tue, 20 Sep 2011 16:17:39 GMT

Hi,

It's ok after I open PAN agent console and click get group as you guide me. Other question is I must open PAN agent console and click get group after I add new user into AD? It isn't make sense to do this thing. I must always open PAN agent console?

Thanks you

Re: No result from "show user pan-agent user-IDs" command

jleung — Wed, 21 Sep 2011 04:05:22 GMT

Hi,

You don't need to do so. Have you tried to add a new user and use that account to logon any one of the PCs? PA needs to see the user in AD log in order to have user to IP mapping. Also, if that user logon through a DC which is not added to the PAN agent, we won't see the log as well.