topic Can't find user for security policy rule in General Topics

Can't find user for security policy rule

MikeC — Sat, 07 Nov 2020 18:49:50 GMT

Having a bit of an issue but can't seem to pinpoint the solution.. When I go to add a security policy rule, under user, i cannot find specific users. However, when I go to the traffic monitor tab, I can see the user mapping is working from the User-ID agent, since I can find those same users there.

Not tied to a specific firewall as I'm not able to find these users on any firewall or panorama. If I add the user by pasting in the distinguished name in the security policy rule, it finds the user, but that is tedious

Re: Can't find user for security policy rule

BPry — Sun, 08 Nov 2020 02:03:20 GMT

@MikeC,

Does the user include any sort of special characters or anything if it's the same users that are breaking?

Re: Can't find user for security policy rule

MikeC — Sun, 08 Nov 2020 14:32:46 GMT

Two of the users have periods (.) in their display name, but I have other users with this as well. Another user that doesn't show up is a new user, standard, nothing special about it. Seems to be a new issue because a new user that was created in the middle of the week shows up.

Re: Can't find user for security policy rule

BPry — Sun, 08 Nov 2020 18:38:50 GMT

@MikeC,

You said this was happening across multiple firewalls and your panorama instance right? So if it's not tied to a single device then it would appear far more likely it could potentially be an issue with how your pulling the group mapping.

Re: Can't find user for security policy rule

MikeC — Mon, 09 Nov 2020 01:35:51 GMT

@BPry

Correct, multiple firewalls/panorama. I originally thought it was group mapping, since I do a group include list and these users are not part of any of those groups. What threw me off is, other similar users do show up and they are not part of any of the groups that I include in the group mapping

That indeed was the issue though. Very weird that some of the other accounts that are not part of the group mapping were showing up. Thanks !