topic Re: User-ID mapping when host has 2 interfaces in General Topics

User-ID mapping when host has 2 interfaces

craig.brooker — Thu, 27 Apr 2017 14:06:21 GMT

We've run into a problem which I understand, I'm just not sure how to fix. A user on her laptop logs into the domain while her laptop is docked, so UIA has her ip address mapping to the wired connection. Later, she undocks and flips over to wireless, but UIA no longer has a valid mapping for her since she AD still associates her wired IP address with her ID. Once she redocks and starts accessing again with her wired IP, the original mapping is valid again and she is properly identified.

Has anyone encountered this and come up with a good resolution?

Re: User-ID mapping when host has 2 interfaces

bradk14 — Thu, 27 Apr 2017 14:09:47 GMT

the solution is to have your WLC or RADIUS server or whathaveyou to send syslog messages to the PA/UID Agent to map usernames with IPs

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/user-id/configure-user-id-to-receive-user-mappings-from-a-syslog-sender.html

Re: User-ID mapping when host has 2 interfaces

Brandon_Wertz — Mon, 01 May 2017 14:02:40 GMT

@bradk14 is right. I've had this same problem in my environment as well ( https://live.paloaltonetworks.com/t5/General-Topics/Dual-NIC-IP-Mapping-Issue/m-p/5936#M4320 )

I opened a ticket with Microsoft and never could get to the bottom of it...Basically you're at the mercy of the randomness of the Windows OS and what NIC is used when authenticating to the DC.

So really you've got 3 options.

First (probably Palo "recommended") - Use global protect client. While not necessarily ideal for everyone's environment (adding another client to an image) it provides 100% accountability.

Second - Do as Brad suggests and try adding the log source to your user ID environment. This too might be overly burdensome especially if you have a lot of authentication sources.

Third - Leverage Captive Portal and hope for the best

Unfortunately your "cleanest" and most reliable solution will be GP.

Re: User-ID mapping when host has 2 interfaces

craig.brooker — Tue, 02 May 2017 13:20:19 GMT

Thanks to both of you for the recommendations and background info. Since we use ISE for wireless authentication we're going to try syslog monitoring of it with a fallback to captive portal if needed.