topic Re: User-id not working correctly in General Topics

User-id not working correctly

DKanta — Fri, 03 Nov 2017 11:49:27 GMT

Hi All!

i have a issue with the user-id feature: some users are not recognized by the PA device: if i check the logs searching for the username i see the last access some days ago, but if i search for his ip he is doing traffic.

Even checking via CLI with ' show user ip-user-mapping all | match username ' i don't see anything.

PA is running PAN-OS 7.0.7 (i know it is going to be in EOL, we will plan the upgrade).

Can you please give me some hints to check?

Regards,

Daniele

Re: User-id not working correctly

Mick_Ball — Fri, 03 Nov 2017 12:13:43 GMT

what is tour user identification timeout set to?

Re: User-id not working correctly

DKanta — Fri, 03 Nov 2017 13:26:22 GMT

hi Mick,

the user id timeout is set to 600 min, but i don't think it is the issue, because for a user i had'nt trace for 15 days.

Regards,

Daniele

Re: User-id not working correctly

Mick_Ball — Fri, 03 Nov 2017 14:56:47 GMT

does "show user ip-user-mapping all" display any mappings?

Is the server monitoring status showing "connected"

have you tried "debug user-id refresh user-id ip <IP-Address> agent <User-ID Agent>" to update the PA database

Re: User-id not working correctly

DKanta — Fri, 03 Nov 2017 15:04:16 GMT

Hi Mick,

if i perform "show user ip-user-mapping all" works correctly, as i told in the discussion's opening, only some users aren't recognized, not all.

DCs are shown as connected.

I will try to perform that debug command.

Regards,

Daniele

Re: User-id not working correctly

Mick_Ball — Sun, 05 Nov 2017 15:01:53 GMT

Are all your DCs the same version?

Is it worth searching the DC security logs to ensure user has actually registered an ip address.

could you confirm the group membership of the service account used to interrogate logs.

more “clutching at straws” really but you never know...

also... have you tried to use the windows server user-id agent.

this has pretty good dynamic logging and search capabilities.

we have 4 pointing to 12 DCs and seems to work well.

Re: User-id not working correctly

Mick_Ball — Sun, 05 Nov 2017 15:06:02 GMT

To boot.... sorry...

have you checked user mapping on each user id profile, rather than “all”.