topic User-ID stopped working / Failed to add group to id manager in General Topics

User-ID stopped working / Failed to add group to id manager

enssenje — Wed, 13 Feb 2019 14:48:44 GMT

Hi Folks,

just to let you know, since I found no KB Articel for this issue. Policy Push from Panorama respectively local Commit on the Firewalls ended in strange Error Message according Group Assignment to Policy.

vsys1
Error: Failed to add group to id manager
Error: Failed to parse security policy
(Module: device)
Commit failed

Cure comes with CLI Command: "debug user-id reset user-id-manager type user-group"

-> configure
-> commit force

Works like a charme!

Re: User-ID stopped working / Failed to add group to id manager

TBardIPsoft — Thu, 12 Aug 2021 16:19:34 GMT

This can work for most commit issues as well (from my experience). I would like to add a note on what I was seeing here to maybe help others. I have "Group Mapping Settings" pushed from Panorama to my devices globally, sadly the "Groups Included List" does not work properly when pushed to devices. I have to go in and override the mappings on each device removing the include groups and adding them back in the override.

A commit force does work from the local device but when pushing the Template and Group Config you still get:

Details:
. vsys1
. Error: Failed to add group to id manager
. Error: Failed to parse security policy
. (Module: device)
. Commit failed

This is where the override comes in to fix this on the Panorama push. The issue here is the firewall(s) don't have the group mapped that is being used in the security policy. Again this is because Panorama does not properly populate the included groups in the Group Mapping config.

Re: User-ID stopped working / Failed to add group to id manager

tcleghorn — Fri, 01 Aug 2025 16:58:09 GMT

Another possibility is too many Groups from Group Mapping or Users in the Groups. Most firewalls have a limit of 10,000 Groups. Anymore than that and we've got to limit that with filters. Confirm with

show user group-mapping statistics