topic Re: IP - User mapping has stopped working in General Topics

IP - User mapping has stopped working

DavePalo — Mon, 25 Jun 2012 10:24:33 GMT

Hi all,

I'm having a IP-user mapping problem with my PA-500 unit running software version 3.1.8.

This unit is due to be upgraded shortly, but it would really be appreciated if anybody knew a way of resolving my issue without rebooting the unit please. Downtime is difficult.

User Identification Agent is installed on a Windows machine and is able to obtain and display username information. Clicking on "Get All" in the agent returns a full list of users and IPs.

The PA-500 has a pan-agent connection defined pointing at the above server and until last week has worked perfectly. This week the PA-500 does not seem to be able to resolve IPs to users.

From the command line the "show user pan-agent statistics" command returns the following:

---------------- --------------- ----- ------- ------------------ ------ ------ -------- -------- -------- --------------- -----

Name IP Address Port Vsys State Users Grps IPs Activity Timer(s) Domain Index

---------------- --------------- ----- ------- ------------------ ------ ------ -------- -------- -------- --------------- -----

xxxxxxx.xxxx xx.xx.xx.xx 12345 vsys1 *connected, ok 696 336 355563 793 300 xxxxxxxxxxxxx 0

"show user ip-user-mapping" returns the following:

IP Ident. By User Idle Timeout (s) Max. Timeout (s)

--------------- --------- -------------------------------- ---------------- ----------------

Total: 0 users

If I do the above command on another of my PA units I get a list of the address mappings back. (I don't have any other 3.1x boxes to compare with though only 4.1x boxes)

To me, it looks as though the agent is working OK and that the PA unit has made a connection to it. Is there something on the PA unit I can reset? I've tried clearing the user-cache but that has made no difference.

Any help appreciated!

Thanks,

Dave

Re: IP - User mapping has stopped working

mharding — Mon, 25 Jun 2012 13:13:57 GMT

There's a "debug user-id reset user-id-agent all" command I've had sucess with in the past.

There's also a process you can restart under "debug software restart" but I don't remember on PAN-OS 3.1 if it's user-id or pan-agent.

Re: IP - User mapping has stopped working

DavePalo — Tue, 26 Jun 2012 11:44:19 GMT

Thanks for this.

I have tried a "debug device-server reset pan-agent all" but since issuing this command if I try to vew the "ip-user-mapping" table I just get the message below:

"Server error : Failed to get response from device server. Please try again later."

Is it possible to restart the device server itself or is that pretty much a reboot?

Thanks,

Dave

Re: IP - User mapping has stopped working

mharding — Tue, 26 Jun 2012 16:28:19 GMT

Yes!

debug software restart device-server

But I've heard of mixed results with restarting the device server and problems with the URL filtering, at least in PAN-OS 4.0. After the device server comes back up, show system resources follow and look for devsrvr, and make sure your URL filtering is working (if you have the license).

Re: IP - User mapping has stopped working

DavePalo — Fri, 29 Jun 2012 08:09:21 GMT

Hi, thanks for this.

We ended up rebooting our device in the end. It just stopped forwarding packets after a compile. Upon rebooting full service has been restored - including IP - user mapping 🙂

Many thnaks,

Dave