IP Mappings Disappear Too Soon in log

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

IP Mappings Disappear Too Soon in log

L2 Linker

Hi,

We have two PA-3020 in HA state, PAN-OS is 5.0.4 and we have configured 4 User-ID Agents (for now, in this troubleshoot stage, we are focused on only one agent).

Problem is in IP – user mapping. Sometimes in logs we see user and in very next moment the field for username is blank. The problem is equivalent with section IP Mappings are Created but Disappear Too Soon from Troubleshooting User-ID: Group and User-to-IP Mapping. We checked the potential causes of the problem described in this article, but everything mentioned in it is working correct.

We don’t see any users in DP on firewall:

----------------(active)> show user ip-user-mapping all option count

Total: 0 users

and on MP we have:

----------------(active)> show user ip-user-mapping-mp all option count

Total: 602 users

Don’t know if this means anything, but the same inputs on passive device are showing:

----------------(passive)> show user ip-user-mapping-mp all option count

Total: 0 users

----------------(passive)> show user ip-user-mapping all option count

Total: 28 users

What is the difference within mapping on DP and MP? Could it be reason for IP mappings disappear too soon? Do you have any idea?

We have a plan to make passive device active to see if anything is different, but system is big and playing with active/passive states is not option for now…

Thank you very much!

Best regards,

Vesna.

1 accepted solution

Accepted Solutions

Yes, we have known issue Issue # 64166. Which is fixed in version 5.0.14 and later and 6.0.4 and later.

Since mapping is lost from data-plane that might definitely be the case. Workaround is to reboot the device and upgrade for permanent fix. Hope this helps. Thank you.

View solution in original post

6 REPLIES 6

L5 Sessionator

Hi vesna.djukic ,

Can you run "show system info" and verify if the device's uptime is 388 days or more ? Thank you.

L2 Linker

Hi ssharma,

uptime: 594 days..

I saw this topic https://live.paloaltonetworks.com/message/45961#45961 but I was sure that uptime isn't so long.. Do you think that this could be the same issue?

Thank you!

Yes, we have known issue Issue # 64166. Which is fixed in version 5.0.14 and later and 6.0.4 and later.

Since mapping is lost from data-plane that might definitely be the case. Workaround is to reboot the device and upgrade for permanent fix. Hope this helps. Thank you.

Great!! We will reboot the device and post here a feedback.

Thank you once again!

BR,

Vesna.

L2 Linker

Reboot helped. ssharma, thank you once again.

Btw, does anyone know why exactly 388 days are causing the bug. Smiley Happy

L0 Member

Hi Vesna,

The issue is total time "Time data-plane was up + User Time-out" cannot be greater than 388 days(2^25).

This is because the absolute time-out has 25 bits in data structure, This increased to 27 bits in 6.0.4 and later versions and it fixed this issue.

Regards,

Sarath

  • 1 accepted solution
  • 4702 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!