topic Re: Session Clearing in General Topics

Session Clearing

kaysun — Wed, 28 Mar 2012 16:08:36 GMT

I have a PA-500 Firewall. I am trying to test some policies, however, when I add and remove users from groups, the Palo Alto isn't picking this up fast enough. Does anyone know the command line to clear out a session from the Palo Alto so it will re-check which group a user is in?

Thanks!

Re: Session Clearing

sspringer — Wed, 28 Mar 2012 18:25:51 GMT

If you are running 4.1 you can use the following command to refresh group mappings

> debug user-id refresh group-mapping all

If you are still having problems you can try to clear groups and reset the connection to LDAP

> debug user-id clear group all

> debug user-id reset group-mapping all

I have seen some strange cases when changing user group information it is not populating correctly in LDAP. If you are still not seeing correct group information it may be worthwhile to use a LDAP browser such as Softerra to confirm the group information.

- Stefan

Re: Session Clearing

kaysun — Fri, 30 Mar 2012 19:20:20 GMT

I am running 4.1. So if I type that directly in a command line the Palo Alto will re-check with LDAP to find out who is in what AD Security group?

Re: Session Clearing

kaysun — Fri, 30 Mar 2012 20:58:25 GMT

Worked awesome. I can add and remove users from Windows groups and test exactly like I wanted. thanks!!!