We have two PA-3020 in HA state, PAN-OS is 5.0.4 and we have configured 4 User-ID Agents (for now, in this troubleshoot stage, we are focused on only one agent).
Problem is in IP – user mapping. Sometimes in logs we see user and in very next moment the field for username is blank. The problem is equivalent with section IP Mappings are Created but Disappear Too Soon from Troubleshooting User-ID: Group and User-to-IP Mapping. We checked the potential causes of the problem described in this article, but everything mentioned in it is working correct.
We don’t see any users in DP on firewall:
----------------(active)> show user ip-user-mapping all option count
Total: 0 users
and on MP we have:
----------------(active)> show user ip-user-mapping-mp all option count
Total: 602 users
Don’t know if this means anything, but the same inputs on passive device are showing:
----------------(passive)> show user ip-user-mapping-mp all option count
Total: 0 users
----------------(passive)> show user ip-user-mapping all option count
Total: 28 users
What is the difference within mapping on DP and MP? Could it be reason for IP mappings disappear too soon? Do you have any idea?
We have a plan to make passive device active to see if anything is different, but system is big and playing with active/passive states is not option for now…
Thank you very much!
Solved! Go to Solution.
uptime: 594 days..
I saw this topic https://live.paloaltonetworks.com/message/45961#45961 but I was sure that uptime isn't so long.. Do you think that this could be the same issue?
Yes, we have known issue Issue # 64166. Which is fixed in version 5.0.14 and later and 6.0.4 and later.
Since mapping is lost from data-plane that might definitely be the case. Workaround is to reboot the device and upgrade for permanent fix. Hope this helps. Thank you.
The issue is total time "Time data-plane was up + User Time-out" cannot be greater than 388 days(2^25).
This is because the absolute time-out has 25 bits in data structure, This increased to 27 bits in 6.0.4 and later versions and it fixed this issue.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!