topic Re: Agentless User-ID "Not Connected" in General Topics

Agentless User-ID "Not Connected"

RobinClayton — Thu, 09 Aug 2018 15:00:46 GMT

PAN-OS 8.0.9

Server 2008-R2

I am in the process of investigating the setup of User-ID, utilising our test network which has a VM500

I am starting using the Agentless option. ( The production site has 500 users, mostly Citrix Terminal Sessions but also Some PC's so I guess I will also need the TS agent further down the line.)

I have done the three basic steps that seem to be outlined in every guide

Create service account with Domain Admin privs.

In user mapping server monitorig Discovered the DC's...

added the WMI Authentication Creds on agent setup.

Committed...

But all i get is "Status [Not Connected]"

Can't seem to find any info on why it's nto working?

Re: Agentless User-ID "Not Connected"

Mick_Ball — Thu, 09 Aug 2018 17:05:59 GMT

By default the user id will try to connect to the server via management port. If this is an issue then change it in device/setup/services

there are other rasons but start with this one as it caught me out...

*reasons not rasons lol.

Re: Agentless User-ID "Not Connected"

reaper — Fri, 10 Aug 2018 07:24:39 GMT

you can use tcpdump in the CLI and filter for your AD to see if packets are going out and being replied to properly

(view by > view-pcap mgmt-pcap mgmt.pcap )

Re: Agentless User-ID "Not Connected"

RobinClayton — Fri, 10 Aug 2018 09:18:02 GMT

Well the PCAP did not give much joy, although it did show some "ICMP unreachable" to the server...

The server Pinged fine on the CLI by "ShortDN" and "FQDN"

HunchTime.....

So althoug I could ping from the management interface, there seemed to be some issue with the Management Plane making some connection via DNS entry..

I added another server in the list but specified it by IP rather than DNS name... Committed , Connected!

No idea if the production environment will have the same issue but at least I have a workarround..

Cheers

Rob

Re: Agentless User-ID "Not Connected"

Mick_Ball — Fri, 10 Aug 2018 09:26:05 GMT

ok nice one...

why dont you just modify the original server entry to "IP Address" just to make sure its nothing else in that server config causing the issue.

also add fqdn to second entry... just for dns test purpose