topic Re: Panagents and Active Directory sub-domains in General Topics

Panagents and Active Directory sub-domains

cloughr — Mon, 07 Nov 2011 19:13:05 GMT

We have an Active Directory domain with a sub domain- bar.org and foo.bar.org. We have 4 panagent servers, 2 dedicated to each. Our problem is that when user A.bar.org logs on, PA sometimes identifies him as user B.foo.bar.org, with the same IP address.

I can re-create this problem by logging onto a machine first as a member of bar.org, then foo.bar.org. I suspect multiple logons to a single machine, plus short IP lease times are the issue. Is there a solution for this?

Re: Panagents and Active Directory sub-domains

jnguyen — Wed, 09 Nov 2011 04:59:25 GMT

this is a current design limitation since windows does not create a log off event for us to monitor. I assume you have a pan agent for every domain since currently the pan agent can only monitor a single domain.

the reason you are running into this issue is that pan agent (bar.org) and pan agent (foo.bar.org) will retain the user to ip mapping even though the user has logged off that machine.

one work around for this is if the machines allowing WMI probing. you can enable WMI probing on the palo alto device and also lower the age-out timeout. but that can not be lower the the netbios probing timer which is also the timer for wmi.

note: you do not want this it o be to aggressive since you will be forcing the mapping to be deleted from pan agent.

I need to verify but i believe we made some enhancements for this in 4.1 which you can use a single agent for multiple domains.

Re: Panagents and Active Directory sub-domains

cloughr — Wed, 09 Nov 2011 12:48:21 GMT

Thanks, that's very helpful. We do have a panagent for each domain, but we don't currently use WMI probing. I don't believe WMI or NETBIOS is enabled on our clients, but it could be for some.

I will upgrade to 4.1 and monitor, then try your suggestions.

Re: Panagents and Active Directory sub-domains

cloughr — Thu, 17 Nov 2011 16:22:00 GMT

Update- 4.1 does address this. I upgraded earlier this week, and there appears to be a positive impact. Not only can I manage the multiple domains, I can also point to Exchange servers for authentication.

Thanks for the fixes!