Security policy Not process user-ID mapping after upgrade 9.0.4 to 9.0.8

HNguyen — Fri, 12 Jun 2020 13:44:56 GMT

PA-820

FW: 9.0.8

Check use-id mapping in CLI returned fine. Check user group mapping fine but security not process user-ID info.

I have nine PA-820. After upgrade from 9.0.4 to 9.0.8, three of them act up. six of them are working fine. Tech Support still have no clue.

Think about version bug. reinstall no help. Upgrade to 9.1.2h1 no help

-----------------------------

admin@HOB-820> show user ip-user-mapping ip 10.3.0.49

IP address: 10.3.0.49 (vsys1)
User: the-can\hnguyen
From: UIA
Idle Timeout: 35173s
Max. TTL: 35173s
HIP Query: Disabled
Group(s): the-can\hnguyen(359)
cn=ws_monitoronly,ou=web filtering,ou=global,dc=the-can,dc=org(2147483686)
cn=vpn,ou=web filtering,ou=global,dc=the-can,dc=org(2147483689)

admin@HOB-820> show user ip-user-mapping-mp ip 10.3.0.49

IP address: 10.3.0.49 (vsys1)
User: the-can\hnguyen
From: UIA
Timeout: 35162s
Created: 8038s ago
GP User: No
Local HIP: No

-------------------------------------

Re: Security policy Not process user-ID mapping after upgrade 9.0.4 to 9.0.

BPry — Mon, 15 Jun 2020 03:46:11 GMT

@HNguyen,

If it's showing up correctly in the user-id database and not in the traffic logs look at your security zone and verify that the subnet is still listed correctly in the user-acl include-list post upgrade. Kind of sounds like the upgrade could have knocked this out, which would explain the discrepancy you are seeing at the moment.

topic Re: Security policy Not process user-ID mapping after upgrade 9.0.4 to 9.0. in General Topics

Security policy Not process user-ID mapping after upgrade 9.0.4 to 9.0.8

Re: Security policy Not process user-ID mapping after upgrade 9.0.4 to 9.0.