topic How often the Palo Alto LDAP group members get sync if membership changes ? in General Topics

How often the Palo Alto LDAP group members get sync if membership changes ?

ksingh1980 — Mon, 23 Aug 2021 17:06:10 GMT

How often the Palo Alto LDAP group members get sync if membership changes?

If I add few more users into the group in LDAP after two weeks, it is configured on PA to block the sites, will it sync with LDAP groups?

Re: How often the Palo Alto LDAP group members get sync if membership changes ?

aleksandar.astardzhiev — Tue, 24 Aug 2021 07:44:49 GMT

Hi @ksingh1980 ,

If I understand your question correctly you are asking about the "Update Interval" for the Group Mapping, correct?

Interval depends on what you have configured - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/user-identification/device-user-identification-group-mapping-settings.html

If I recall correctly the default value is one hour (3600sec). This means that by default every hour FW will generate LDAP query to get user groups from the Active Directory.

If you add user to group you need to wait for that interval for the firewall to get the update. You can configure short interval, or you can manually force the firewall to sync the user groups, right now:

> debug user-id refresh group-mapping

Re: How often the Palo Alto LDAP group members get sync if membership changes ?

S.Cantwell — Tue, 24 Aug 2021 15:57:26 GMT

Hello again

The interval for LDAP updates is 60 secs.. vs 60 minutes... as shown in the UserID group mapping area.

Re: How often the Palo Alto LDAP group members get sync if membership changes ?

BPry — Tue, 24 Aug 2021 21:57:43 GMT

@S.Cantwell,

Right, what @aleksandar.astardzhiev correctly pointed out is that by default the Update Interval for group-mapping is set to 3600 seconds which is 60 minutes. While you absolutely can set it up to update every 60 seconds, by default the firewall is only updating group membership every 3600 seconds.