topic Re: group mapping in General Topics

group mapping

Retired Member — Thu, 07 Mar 2013 21:03:54 GMT

When we add a group from Active directory gorup list from Group mapping on Panos to right side of that window; it should come to the policy users tab.But sometimes it does not come for a time.Is there a way to refresh that or what is refresh time for that, can we change it ?

Re: group mapping

Abs — Thu, 07 Mar 2013 21:07:08 GMT

Hi Bulent,

When you log in to the CLI and enter the show user group-mapping-service status command, what do you see?

(Now shamelessly accepting the next 49 friend requests.)

Re: group mapping

Retired Member — Thu, 07 Mar 2013 21:36:59 GMT

I see query number 2

and also local :2

but at policy ı see 1 group only.

I first saw this on customer site and tried on my lab and see the same thing.Both panos 5.0.2

Re: group mapping

Retired Member — Thu, 07 Mar 2013 21:38:33 GMT

After some while(about 2 minutes) now it came 2 groups.

What affects this time ?I have to know that.

Re: group mapping

Abs — Thu, 07 Mar 2013 21:42:09 GMT

Device > User Identification > Group Mapping Settings > Choose the group mapping you've created.

There you will see the Update Interval. Adjust to your needs.

(Now shamelessly accepting the following 15 friend requests.)

Re: group mapping

Retired Member — Thu, 07 Mar 2013 21:44:37 GMT

I am choosing from there.But it comes late to policy.that is the problem.if interval is empty isn't it 60 seconds by default ?

Re: group mapping

Abs — Thu, 07 Mar 2013 21:46:59 GMT

No, the default interval when empty is 600 seconds (10 minutes).

Re: group mapping

Retired Member — Fri, 08 Mar 2013 06:45:06 GMT

if the default is 600 seconds why do I see sometime in 2 minutes ?

Re: group mapping

UhMayYeah — Fri, 08 Mar 2013 10:19:09 GMT

The default update timer on group information, if left blank, is 600 seconds. You can change this interval by filling in a number between 60 and 86400 seconds

You can refresh the user-group-mapping by CLI commands :

> debug user-id refresh group-mapping all ..... This command will fetch the only delta values or the difference.

> debug user-id reset group-mapping all ...... This command will fetch the entire group mappings once again.

HTH..!

-AMEYA

Re: group mapping

Retired Member — Fri, 08 Mar 2013 12:38:58 GMT

we tried these commands yesterday but it did not work.

Thanks.