topic Sometime is user authenticate sometime is not in Paloalto in General Topics

Sometime is user authenticate sometime is not in Paloalto

FarhanKoujalgi — Thu, 23 Sep 2021 20:03:48 GMT

Hey, guys, one of my customer have an issue regarding the Source user let me explain in detail.

There is one user having four outlook account in three of them the internet working properly but in one account he selects in outlook and checks the internet connectivity gone and in the logs the Traffic going through a cleanup rule which is the last policy any-any deny which comes before intra inter policy.

In the Traffic logs, the source user is not displaying.

After the customer run the command gpupdate /force command on the windows command prompt. the user is able to access the internet for some time and then the issue is the same

So the user is able to access the internet sometimes and sometimes not.

when the user is able to access the internet I checked see the source user name and going through the User base security policy rule.

I created an IP base rule but the customer was not satisfied with that solution.

so what should I check in Palo alto? or there is an authentication problem but the user is able to access from three different outlook id but not by one.

Re: Sometime is user authenticate sometime is not in Paloalto

BPry — Fri, 24 Sep 2021 01:16:40 GMT

@FarhanKoujalgi,

Sounds like your simply running into a User-ID time-out on the firewall. I'd check what you have the time out value set to on the firewall and see if you actually expect to see more authentication events coming from that client. My guess is that you have the time-out value set relatively low and User-ID simply isn't seeing any authentication logs from this user that frequently and the user IP mapping is being cleared. You'll either need to increase the time-out value or increase the number of authentication events being generated by the endpoint.

Re: Sometime is user authenticate sometime is not in Paloalto

FarhanKoujalgi — Fri, 24 Sep 2021 04:31:44 GMT

Its agentlesss where should i change that timeout value. but it is for only one user.

Re: Sometime is user authenticate sometime is not in Paloalto

FarhanKoujalgi — Mon, 27 Sep 2021 06:47:10 GMT

Dear @BPry

I Checked through ssh show user IP-user-mapping for to particular user

The one says the mismatch and the other one says unknown and after some 5 to 10 minutes I run the same IP user mapping cmd the users are shown is this any strange behaviour that sometimes user mapping shows sometimes not I checked the WMI is enable on firewall and in the server monitoring also server are 4 and connected