topic Re: How does the firewall work when they received unknown-user's packet? in General Topics

How does the firewall work when they received unknown-user's packet?

JTR — Fri, 01 Feb 2013 10:12:53 GMT

Hello, Guys. Nice to meet you.

I'm testing User-ID in PAN OS 4.1 and USER Agent 4.1.

There's something curious situation during my lab test.

I've deleted all ip-user-mapping information with 'clear user-cache all'.

So all users is unknown to firewall.

But the user agent still has ip-user mapping information using WMI probing.

In this case, I think the firewall should ask USER Agent to get ip-user mapping information for the unknown user.

But the firewall can't get any information from the USER Agent, and the user still remains unknown.

and 'num of request of ip mapping msgs sent' doesn't increase.. only 'num of states msgs rcvd' and 'num of request of status msgs sent'

are increasing..

Does any one know why does firewall work like this ?

Thanks.

Re: How does the firewall work when they received unknown-user's packet?

rmonvon — Fri, 01 Feb 2013 18:46:55 GMT

Hi...For unknown users and new connections, the PA would query the userID agent to see if there is a ip-user mapping. Because you manually clear the user-cache and there may be existing sessions, the cache may be populated as unknown.

I suggest you clear user-cache and also clear the session(s) via 'clear session all'. Then generate new connection from that user IP to test. Thanks.

Re: How does the firewall work when they received unknown-user's packet?

JTR — Mon, 04 Feb 2013 06:14:05 GMT

Thanks, rmonvon, It works. But it took more time (about 10 sec) than I've expected. :smileygrin:

Anyway It was very useful , Thanks Again.