topic Re: Entries in User-ID table show info pushed from XMLAPI never timeout in General Topics

Entries in User-ID table show info pushed from XMLAPI never timeout

MelLi — Sat, 02 May 2015 04:14:59 GMT

Hi guys,

My customer previously used XMLAPI to push User-ID info to Palo Alto but they now have an Aruba Clearpass appliance which will be handling all User-ID information via Syslog.

Due to software issues they cannot currently use XMLAPI between Clearpass and Palo Alto as the system has multiple vsys. Now the issue is that there are a lot of entries in the User-ID table from XMLAPI with a timeout of never, they have tried disabling all XMLAPI settings on devices and denying HTTPS traffic from these devices to the Palo Alto yet whenever they clear the User cache these entries are instantly re-populated, an example is shown below.

IP Vsys From User IdleTimeout(s) MaxTimeout(s)

--------------- ------ ------- -------------------------------- -------------- -------------

10.82.233.137 vsys1 XMLAPI xxx\176724 Never Never

10.83.161.130 vsys1 XMLAPI xxxc\pcipad Never Never

Did anyone have ever seen similar issues?

Thanks,

Cheers,

Mel

Re: Entries in User-ID table show info pushed from XMLAPI never timeout

prb — Mon, 04 May 2015 11:12:57 GMT

Hi Mel.Li,

Did you also clear mp cache? I presume you had been trying to clear only dp logs.

Command to clear mp cache,

>clear user-cache-mp all

Clear dp cache followed by mp clear,

>clear user-cache all

Hope this helps.

Thank You.

Re: Entries in User-ID table show info pushed from XMLAPI never timeout

MelLi — Wed, 06 May 2015 23:06:14 GMT

Hi Guys,

thanks for your reply. We did test to clear user information from mp and dp, but the users are still showing up in the user id table as XMLAPI.

We have opened a support case with PA TAC.

Will update once the true cause has been found.

Thanks,

Cheers,

Mel

Re: Entries in User-ID table show info pushed from XMLAPI never timeout

dburns — Thu, 07 May 2015 22:11:33 GMT

What version? And are you sure the API is not being updated? The clear command worked for me. You could also add a timeout and send that to all your api know users therefor they would timeout.

admin@PA-200> show user ip-user-mapping all

IP Vsys From User IdleTimeout(s) MaxTimeout(s)

--------------- ------ ------- -------------------------------- -------------- -------------

192.168.254.1 vsys1 XMLAPI dominic Never Never

Total: 1 users

admin@PA-200> clear user-cache all

All entries in user cache removed!

admin@PA-200> show user ip-user-mapping all

IP Vsys From User IdleTimeout(s) MaxTimeout(s)

--------------- ------ ------- -------------------------------- -------------- -------------

Total: 0 users

admin@PA-200>

Re: Entries in User-ID table show info pushed from XMLAPI never timeout

MelLi — Thu, 07 May 2015 22:43:37 GMT

Hi Dburns,

The commands works for my customer but after a while there are user entries showing XMLAPI again in the user id table.

Customer confirmed they have removed the API setting. But will confirm with them again to see what exactly happend.

Thanks for your comments.

Cheers,

Mel

Re: Entries in User-ID table show info pushed from XMLAPI never timeout

PanIst — Thu, 25 Feb 2021 21:22:19 GMT

Hi,

Do you remember the solution for this old issue ?Or does anyone have any idea ?

we are having the same issue now.Thanks

Regards

Re: Entries in User-ID table show info pushed from XMLAPI never timeout

Ankit1Singh — Mon, 12 Jun 2023 12:17:56 GMT

Hi, anyone got the solution for this? My user entries showing XMLAPI in the place for User-id agents.