topic IP Mappings Disappear Too Soon in log in General Topics

IP Mappings Disappear Too Soon in log

vesna.djukic — Wed, 03 Dec 2014 14:00:08 GMT

Hi,

We have two PA-3020 in HA state, PAN-OS is 5.0.4 and we have configured 4 User-ID Agents (for now, in this troubleshoot stage, we are focused on only one agent).

Problem is in IP – user mapping. Sometimes in logs we see user and in very next moment the field for username is blank. The problem is equivalent with section IP Mappings are Created but Disappear Too Soon from Troubleshooting User-ID: Group and User-to-IP Mapping. We checked the potential causes of the problem described in this article, but everything mentioned in it is working correct.

We don’t see any users in DP on firewall:

----------------(active)> show user ip-user-mapping all option count

Total: 0 users

and on MP we have:

----------------(active)> show user ip-user-mapping-mp all option count

Total: 602 users

Don’t know if this means anything, but the same inputs on passive device are showing:

----------------(passive)> show user ip-user-mapping-mp all option count

Total: 0 users

----------------(passive)> show user ip-user-mapping all option count

Total: 28 users

What is the difference within mapping on DP and MP? Could it be reason for IP mappings disappear too soon? Do you have any idea?

We have a plan to make passive device active to see if anything is different, but system is big and playing with active/passive states is not option for now…

Thank you very much!

Best regards,

Vesna.

Re: IP Mappings Disappear Too Soon in log

ssharma — Wed, 03 Dec 2014 14:36:37 GMT

Hi vesna.djukic ,

Can you run "show system info" and verify if the device's uptime is 388 days or more ? Thank you.

Re: IP Mappings Disappear Too Soon in log

vesna.djukic — Wed, 03 Dec 2014 14:43:01 GMT

Hi ssharma,

uptime: 594 days..

I saw this topic https://live.paloaltonetworks.com/message/45961#45961 but I was sure that uptime isn't so long.. Do you think that this could be the same issue?

Thank you!

Re: IP Mappings Disappear Too Soon in log

ssharma — Wed, 03 Dec 2014 14:51:03 GMT

Yes, we have known issue Issue # 64166. Which is fixed in version 5.0.14 and later and 6.0.4 and later.

Since mapping is lost from data-plane that might definitely be the case. Workaround is to reboot the device and upgrade for permanent fix. Hope this helps. Thank you.

Re: IP Mappings Disappear Too Soon in log

vesna.djukic — Wed, 03 Dec 2014 15:29:13 GMT

Great!! We will reboot the device and post here a feedback.

Thank you once again!

BR,

Vesna.

Re: IP Mappings Disappear Too Soon in log

vesna.djukic — Wed, 03 Dec 2014 22:54:35 GMT

Reboot helped. ssharma, thank you once again.

Btw, does anyone know why exactly 388 days are causing the bug.

Re: IP Mappings Disappear Too Soon in log

sbabu — Wed, 03 Dec 2014 23:36:51 GMT

Hi Vesna,

The issue is total time "Time data-plane was up + User Time-out" cannot be greater than 388 days(2^25).

This is because the absolute time-out has 25 bits in data structure, This increased to 27 bits in 6.0.4 and later versions and it fixed this issue.

Regards,

Sarath