topic Re: Source User Missing. Device has User Mappings. in General Topics

Source User Missing. Device has User Mappings.

ppeters86 — Tue, 27 Jun 2017 14:23:50 GMT

I'm sure this is probably a rookie mistake, but I have to ask...

I've set up our Meraki access points to syslog to my PA500 firewall. I'm successfully getting user-id to IP address mappings (I can see them in the output of "show user ip-user-mapping all" in the CLI). However, in the web interface, nothing is showing up in the source user column. I've looked in the traffic logs, the URL filtering logs, the User Activity area of the ACC tab (Network Activity). Nothing.

It feels like there's some setting I'm missing, but I can't find it.

Any help for the rookie would be appreciated.

Re: Source User Missing. Device has User Mappings.

ppeters86 — Tue, 27 Jun 2017 14:25:36 GMT

Forgot to mention. I'm running the 8.0.2 version of the software.

Re: Source User Missing. Device has User Mappings.

TranceforLife — Tue, 27 Jun 2017 14:55:45 GMT

Did you enable user-id under the zone (s)?

Re: Source User Missing. Device has User Mappings.

Brandon_Wertz — Tue, 27 Jun 2017 15:00:41 GMT

To piggy back on what @TranceforLife mentioned be sure to not enable user-id on INet/Public facing zones as you're potentially exposing your user base to exploit and capture.

Re: Source User Missing. Device has User Mappings.

TranceforLife — Tue, 27 Jun 2017 15:08:45 GMT

Good point. Be careful enable ONLY for internal/trusted zone.

Re: Source User Missing. Device has User Mappings.

ppeters86 — Tue, 27 Jun 2017 15:13:13 GMT

Like I said, rookie mistake....

SMH

Thanks for the pointer.

Re: Source User Missing. Device has User Mappings.

ulti — Thu, 16 Nov 2017 21:00:13 GMT

which syslog filter did you use for meraki? did you create a custom one or use one of the ciscos?