topic PA and AD Integration in General Topics

PA and AD Integration

RustyPA — Wed, 10 Aug 2016 18:40:29 GMT

My PA is experiencing a lag between when user accounts are modified in the AD group used for VPN authentication and when the PA begins enforcing the new account settings. Is this fixable? What is the maximum lag that I should be seeing? Is it possible for an account to be disabled in AD and there be a lag between when the user can no longer log in?

Re: PA and AD Integration

Raido_Rattameister — Wed, 10 Aug 2016 19:42:01 GMT

Hey

By default it is 1 hour.

https://live.paloaltonetworks.com/t5/Management-Articles/What-is-the-Default-Update-Timer-Value-for-Group-Mapping/ta-p/53437

You can manually update with cli command below.

debug user-id refresh group-mapping all

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Force-User-Group-Mapping-Refresh/ta-p/62597