topic Re: PAN OS 7.1.14 AD issues after update in General Topics

PAN OS 7.1.14 AD issues after update

mmcastr — Thu, 14 Dec 2017 12:41:02 GMT

After update PAN OS to release 7.1.14 we are having problems with user identification.
The user credentials are lost in PA and some access are denied because PA can not identify the user.

Have anyone experiencing something like that on 7.1.14?

Re: PAN OS 7.1.14 AD issues after update

Mick_Ball — Thu, 14 Dec 2017 12:58:19 GMT

if it's only some and not "all" try increasing "user identification timeout"

Re: PAN OS 7.1.14 AD issues after update

mmcastr — Thu, 14 Dec 2017 13:08:47 GMT

We've just talked about your suggestion here.
We are trying this change on settings as a workaround for now.

Thanks

Re: PAN OS 7.1.14 AD issues after update

Mick_Ball — Thu, 14 Dec 2017 13:11:48 GMT

OK but please note that the user will have to be entered in the AD security log for the ip address to be mapped.

a log off and back on to the domain will suffice

Re: PAN OS 7.1.14 AD issues after update

mmcastr — Thu, 14 Dec 2017 17:08:28 GMT

I opened a case on Palo Alto and the System Engineer discovered that it is a problem started on release 7.1.11 and will be fixed on release 7.1.15.
The workaround for it by now is the command below that it must be applied on every restart because it does not be salve on settings.

>debug user-id query-unknown-ip yes

Re: PAN OS 7.1.14 AD issues after update

Mick_Ball — Thu, 14 Dec 2017 18:09:28 GMT

Ok nice one, thanks for updating the post.