topic Re: Identifying user rules UserID in General Topics

Identifying user rules UserID

soporteseguridad — Fri, 23 Dec 2016 10:06:55 GMT

Hi,

We are expecting several issues with user identificatiom. We see connections identifying users but suddently the connections stop identifying.

I attach an screenshot

Re: Identifying user rules UserID

kiwi — Fri, 23 Dec 2016 10:37:53 GMT

Hi @soporteseguridad,

It looks like users are losing their IP mapping.

Check this document : https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-User-ID-Group-and-User-to-IP-Mapping/ta-p/59072

The section "IP mappings are created but disappear too soon" might help you on your way.

Cheers !

-Kim.

Re: Identifying user rules UserID

soporteseguridad — Wed, 28 Dec 2016 09:14:29 GMT

We are using SYSLOG in Palo to take the users.

If we go into "show user ip-user-mapping all | match 10.162.246" we see that user: mcabr is identified correctly but going into traffic logs we see connections where mapping is lost.

(active)> show user ip-user-mapping all | match 10.162.246

10.162.246.22 vsys1 SYSLOG mcab.in 2353 2353

10.162.246.20 vsys1 SYSLOG mcab.in 2406 2406

10.162.246.23 vsys1 SYSLOG mcab.in 1545 1545

(active)> show user ip-user-mapping all | match 10.162.246.

10.162.246.23 vsys1 SYSLOG mcab.in 1518 1518

(active)> show clock

Wed Dec 28 09:24:07 CET 2016

Re: Identifying user rules UserID

RFalconer — Wed, 28 Dec 2016 22:19:08 GMT

Has this method of user-id ever worked correctly?

Re: Identifying user rules UserID

Es_tecsupportsecurity — Thu, 29 Dec 2016 09:38:55 GMT

im not sure. Palo alto uses syslog server for mappings......

Re: Identifying user rules UserID

OtakarKlier — Thu, 29 Dec 2016 15:56:00 GMT

Hello,

This is usually caused by the 'User Identification Timeout'. Happened to me a few times as well. If you are using agents, go into the setup and change the timeout value:

If you are using agentless, log into the PAN and change the value there:

Hope this helps.