topic Intermittent username drops in General Topics

Intermittent username drops

SThatipelly — Fri, 12 Jan 2018 18:55:25 GMT

Username-IP mappings intermittently stops and traffic logs show just IP but not username. And mapping happens after sometime automatically. This is limiting me from creating rules based on usernames. What might be the reason?

Thanks.

Re: Intermittent username drops

BPry — Fri, 12 Jan 2018 22:07:44 GMT

@SThatipelly,

More than likely you are running into a timeout for the User-ID info. Do you know what you have your 'User Identification Timeout' value set to?

This can be found under the 'Device' tab under the 'User Identifcation' section.

Re: Intermittent username drops

SThatipelly — Fri, 12 Jan 2018 22:11:47 GMT

480 mins

Re: Intermittent username drops

BPry — Fri, 12 Jan 2018 22:19:06 GMT

@SThatipelly,
That should be allowing enough time in most environments. Can you explain your setup a little more. Specifically what are you monitoring as a source and whether you use the agentless or agent. It sounds like this is indeed your problem, just trying to figure out if we can redesign your user-id setup without having to increase the age out.

Re: Intermittent username drops

OtakarKlier — Fri, 12 Jan 2018 22:20:26 GMT

Hello,

Also where are you getting the logs from? I found Exchange is sometimes better since Outlook is authenticating to it quite frequently so the IP to username mappings are pretty up to date.

Regards,

Re: Intermittent username drops

Mick_Ball — Sat, 13 Jan 2018 11:05:59 GMT

Could you also confirm if this is happening to random users. Or are you losing all ip mappings. This may assist in whether your issue is with user-id timeouts or coniguration/communication issues.

Re: Intermittent username drops

TomSpears — Mon, 29 Jan 2018 22:34:47 GMT

We've been running into some UID mapping issues, running in agentless mode. It turns out that since we have multiple domains, we weren't uspposed to be using agentless. Instead, PAN advised us to stand up a vm/server in each domain and put an agent on it that can reach out and query the DCs. We were having the same issue, where we were only getting 50-60% of the UIDs. Sometimes we'd get UID, and then it would just drop. We also tried doing switch user, and the UID would still be for the first user.

Or you can enforce Captive Portal, but that's really more of a catch-all.

Re: Intermittent username drops

SThatipelly — Tue, 30 Jan 2018 13:24:30 GMT

Yes. I too was adviced to install user-id agent.

Are they sure if this could fix the issue?