topic Re: Upgraded to 5.0.9 ? User Identification stops working? in General Topics

Upgraded to 5.0.9 ? User Identification stops working?

paulmeys — Mon, 30 Dec 2013 08:43:19 GMT

Hi,

I had 2 PA's running with user-identification using the user-id-agent.

Both have the same config, running 5.0.7

I upgraded both to 5.0.9

one is working fine, the other one does not "see" the user anymore.

Tried the normal stuff: reboot, reinstall, tried 5.0.8 ( same problem ), checked the user-id-agent (connected), ...

When I revert to 5.0.7, everything is fine again.

Anyone seeing the same behavior ?

Thanks,

Kind regards,

Paul

Re: Upgraded to 5.0.9 ? User Identification stops working?

HITSSEC — Mon, 30 Dec 2013 15:32:20 GMT

Paul,

We have not seen the issue. We went from 5.0.7 to 5.0.8 to 5.0.9 without seeing any issues relating to the user identification. We have 2 PAs in an Active/Passive config. We point the PA to two different servers running the user-id agent version 5.0.6-6.

Have you tried updating the User-id agent if not on 5.0.6-6?

Phil

Re: Upgraded to 5.0.9 ? User Identification stops working?

dpalani — Mon, 30 Dec 2013 22:19:48 GMT

Hello Paul,

Based on your explanation, it looks like a config migration issue. Following command will show if the firewall is connected to the user id agent "debug management-server conn", if the connection to the user id agent is seen, check for the stats with

"show user user-id-agent statistics". If these two tests fail. Reconfigure the user id agent on the firewall.

Regards,

Deepak

Re: Upgraded to 5.0.9 ? User Identification stops working?

SimmSimm — Thu, 02 Jan 2014 12:16:54 GMT

I found when updating to 5.0.9 from 4.1.x that some old rules for excluding networks from user id scanning (Network tab -> Zones) reappeared in some strange way - at the time I put it down to me being a bit far fingered, but maybe this applies in your case too ?