topic Re: Loosing USER-ID in General Topics

Loosing USER-ID

RobinClayton — Fri, 04 Jan 2019 16:34:33 GMT

Our AD based USER-ID seems to keep loosing the IP/USER association.

We only have a few rules which work some of the time and then fail with a blank user.

What's the best solution to get it 100%???

Rob

Re: Loosing USER-ID

Mick_Ball — Fri, 04 Jan 2019 17:00:26 GMT

is your user id timeout set to the default 45 mins.

just set it to either 4 hours or 8 hours (mins equiv)

I have mine set to 24 hours...

Re: Loosing USER-ID

RobinClayton — Fri, 04 Jan 2019 17:06:43 GMT

Yes 45 mins.

Do new users logins on the same system get picked up ok with that setting of 24Hrs?

Cheers

Rob

Re: Loosing USER-ID

Mick_Ball — Fri, 04 Jan 2019 17:18:00 GMT

Rob, not sure what you are asking. but yes..

although the timeout setting is global to all users, it is not a global timer...

so each user, as they authenticate with AD will start there own 24 hour timer for there own mapping.

i think existing mappings will only pick up the new timeout on next authentication.

24 hour is overkill, i only have it as we aslo use Network Access Control on our switches.

4 hours is good practice as usualyy stop for lunch, (lock laptop) 8 hours is a safer bet.

the other option is to use mapping against email server or similar. whatever has the most activity..

Re: Loosing USER-ID

Mick_Ball — Fri, 04 Jan 2019 17:26:17 GMT

please note that if an old mapping exists from earlier and your scope runs out of IP addresses then a non AD user could obtain an address of an old mapping prior to it timing out, probably didn't explain that very well, post back if you neeed more info.

Re: Loosing USER-ID

pdasari — Fri, 03 Apr 2020 05:50:04 GMT

@Mick_Ball I like it how you said 4hrs or 8hrs is safer bet.We use WMI probing.The current timeout we have now set is 10hrs. The probe time is set to 20min.

At our company as all of has work from home situation users are jumping on and off the VPN to avoid latency with Zoom/Webex or bypass the FW rules or whatever. Because of this, the IP addresses becomes free and the new user logging onto Pulse gets them.The firewall hasn't reached its 10hour period and the new user gets the old user's User ID and the new user happened to be an executive and gets the block page.

What is the ideal way to resolve such issues when the IPs are so frequently changed, default of 45min? But what happens if something chnages in that 45min time period? Is there more real time information for firewall somehow?