topic Re: Traffic processing when user information may be outdated in General Topics

Traffic processing when user information may be outdated

MilosS — Mon, 07 Nov 2016 12:17:52 GMT

Hello!

Could you please expalin what's the default traffic policy when new authentication agent/AD DC info is unavailable for some reason.

Does the user-based rules get automatically turned off or someting?

Does the traffic which gets under user-based firewall rules get passed or dropped?

Re: Traffic processing when user information may be outdated

TranceforLife — Mon, 07 Nov 2016 13:12:40 GMT

No policies are not changing dynamically. It will use a cache, think it is 45 minutes then your policy wouldn't match and traffic will hit a default deny rule.

Re: Traffic processing when user information may be outdated

MilosS — Mon, 07 Nov 2016 13:26:26 GMT

And what if some villain uses valid user IP to match cache value? 🙂

Is there some alert that authentication cache may be outdated?

Re: Traffic processing when user information may be outdated

santonic — Mon, 07 Nov 2016 14:02:14 GMT

He wouldn't be able to put a single packet on network cause of duplicate IP address 🙂

User-ID works on IP to user mapping table. This table is populated either through AD queries, reading AD logs, GP authentication or captive portals. Command "show user ip-user-mapping all" in CLI shows this table. This table is used when mapping users to IP addresses.

Each entry has a sort of time-to-live atribute called timeout. Losing connectivity with AD won't change this table. But eventually AD entries in this table will timeout and users won't be 'recognised' again. Which means rules with user restrictions won't match any more for these users.