topic Re: Agentless User-ID Question in General Topics

Agentless User-ID Question

BPry — Thu, 04 Aug 2016 15:20:58 GMT

So I've been under the impression that our PA-3020s contact the ADDC servers to authenticate users every 20 minutes when it's setup to do a probe; then caches this information locally so that it isn't constantly hammering the servers with WMI requests. I've been told that this isn't the case and that they are hitting the server every few seconds. Is there somewhere were I can tell the 3020s to simply look at the cached information unless it identifies a user not in the cache, or the 20 minute window is hit and it needs to go and check for new users/groups?

I've included a screenshot of both the User Idnetification field, everything under the actual LDAP server settings are set as follows; Bind Timeout=30 / Search Timeout= 10 / Retry Interval= 60.

Is this something that can actually be modified to use the cache or will it by default do a WMI query every time?

Re: Agentless User-ID Question

Brandon_Wertz — Mon, 08 Aug 2016 17:38:54 GMT

WMI probing is for the end clients not the domain controllers.

As indicated by your screen shot the firewall probes the DCs every 2 seconds for any new event IDs the firewall will then only keep the 4 that it needs for the passive IP to user ID attribution.

What are you trying to limit? Are you DCs being overworked? The highest you'd probably want to extend that query time out to would probably be 15 seconds. Though 15 seconds might be too long and if your user was quick enough you might have a user that tries to access the Internet or whatever you're mandating user attribution for, before that 15 second timer.

Re: Agentless User-ID Question

BPry — Mon, 08 Aug 2016 19:59:05 GMT

Thanks! I started to look into this a little more and found a petter article than what I was seeing previously. Our system engineer just asked why it was hitting the DCs so often since he had to allocate more resources to them; I didn't have the answer since I thought the probing setting was when it was going out to the server and requesting the user-id information, not every 2 seconds.