topic Re: nt-autorität\anonymous-anmeldung in General Topics

nt-autorität\anonymous-anmeldung

w.naderer — Fri, 13 Apr 2018 06:52:08 GMT

Hello Guys,
I have sometimes a problem with the user identification on the PA500. Our Users can only browse the internet with your AD-User. Sometime the User is lost on the PA. The User "nt-autorität\anonymous-anmeldung" is used? Why? How can I find a solution?

Thanks

cu
Wolfgang

Re: nt-autorität\anonymous-anmeldung

Chacko42 — Fri, 13 Apr 2018 07:13:33 GMT

You should exclude this user from user id by adding him to the ignore user list.

As far as I know, this user is for anonymous accessing e.g. printers or shares if configured.

Re: nt-autorität\anonymous-anmeldung

w.naderer — Fri, 13 Apr 2018 08:56:41 GMT

Hi Chacko42,

I had this done...but it's not the solution 😞

Any other Idea?

Thanks

Wolfgang

Re: nt-autorität\anonymous-anmeldung

Chacko42 — Fri, 13 Apr 2018 09:01:02 GMT

Do you receive user-id updates only by using the integrated agent or are there other sources as well?

I assume you can see this user-mapping in current traffic logs? Are these current sessions or older ones?
Can you see the user by querying "show user ip-user-mapping all" on your FW?

Re: nt-autorität\anonymous-anmeldung

Remo — Fri, 13 Apr 2018 09:06:43 GMT

@w.naderer

Do you have netbios probing enabled on the user id agent?

Re: nt-autorität\anonymous-anmeldung

w.naderer — Fri, 13 Apr 2018 09:07:40 GMT

We have installed the Palo Agents on our Active Directory Controller.
Yes, the User is switching automatically from userid into nt\authority... in the current traffic log.

How can I do the command?

Thanks

Wolfgang

Re: nt-autorität\anonymous-anmeldung

Chacko42 — Fri, 13 Apr 2018 09:13:20 GMT

Alright, there is the problem.

The setting in the web UI is only for the agentless User-ID (FW polls DCs directly).

You need to define the ignore-users on the user-id agent on your ADC by creating a file

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/configure-user-mapping-using-the-windows-user-id-agent (search for ignore)

Re: nt-autorität\anonymous-anmeldung

reaper — Fri, 13 Apr 2018 09:16:47 GMT

the ignore list needs to be on the agent on the AD controller, adding the ignore user list on the firewall may only exclude it from locally learned user-ID

you'll need to add "ignore_user_list.txt" in the User-ID install directory, then add the name to the text file

Re: nt-autorität\anonymous-anmeldung

w.naderer — Fri, 13 Apr 2018 09:18:13 GMT

Netbios Probing is YES and the interval is 20 minutes

I also implemented the ignore list on the ADC

Thanks

Wolfgang

Re: nt-autorität\anonymous-anmeldung

w.naderer — Fri, 13 Apr 2018 10:06:06 GMT

Hi,

Which settings play a role in the comparison?
Can I evaluate something on the User-ID-Agent or does it make sense to delete such entries manually?

Thank you

Wolfgang

Re: nt-autorität\anonymous-anmeldung

reaper — Fri, 13 Apr 2018 10:18:51 GMT

You should try to determine who/what is adding those entries to the firewall user-ip list

If you go into the monitor tab on the UserID agent, is the anonymous-anmeldung user still listed there?

if this is the case, you could try tuning the entries in your exlude_user_list.txt, possibly try restarting the uid service in case it isn't picking up the file

if the user does not exist on the agent, it must originate from somewhere else, possibly the clientless config on the firewall or a different agent

Re: nt-autorität\anonymous-anmeldung

w.naderer — Mon, 16 Apr 2018 05:40:16 GMT

Good morning Reaper,

Yes the "anonymous.." is listing into the monitor tab!

I delete the entry and the right user was shown.

But was is the reason with the anonymous entries? What can I do?

Thanks

Wolfgang

Re: nt-autorität\anonymous-anmeldung

w.naderer — Mon, 16 Apr 2018 13:29:11 GMT

Hello together,

Is it useful to change the parameter "User Identification Timeout" Value?

Thanks

Wolfgang

Re: nt-autorität\anonymous-anmeldung

Remo — Mon, 16 Apr 2018 14:43:12 GMT

Could you try to disable Netbios probing?

Re: nt-autorität\anonymous-anmeldung

w.naderer — Tue, 17 Apr 2018 07:21:36 GMT

I did it - some nt-autorität\anonymous-anmeldung entries are still in the log 😞

Other parameters?

Any other ideas?

THANK YOU

Wolfgang

Re: nt-autorität\anonymous-anmeldung

w.naderer — Fri, 04 May 2018 05:18:14 GMT

Hi,

Disabling Netbios probing doesn't help!!!!

Wolfgang

Re: nt-autorität\anonymous-anmeldung

Remo — Fri, 04 May 2018 16:33:38 GMT

Did you check one of the clients with this user-ip-mapping if there is something that logs on anonymous on that client? Is the user-id agent your only source for user-id or do you have also others?

Re: nt-autorität\anonymous-anmeldung

w.naderer — Mon, 07 May 2018 05:13:15 GMT

It's always a User logged in.

We have two Active DC (Win 2012) with the User-ID-Agent.

Re: nt-autorität\anonymous-anmeldung

w.naderer — Fri, 18 May 2018 05:47:04 GMT

Hi,

I think the solution is/was to store the ignore_user_list.txt as UniCode!!!

Thanks to all

Wolfgang