I have developed a script that collects user-ip mapping from a wireless controller and send this info to User-ID Agent. All these looks fine because I can see the users in the User-ID Agent monitor table, but when I look traffic logs on Palo Alto I can see some logs do not have a user identification and other logs have it, for the same source IP. I attach a screenshot where you can see what I am trying to explain :smileysilly:.
The user-ip mapping is correctly catched by PaloAlto.
admin@PA-500> show user ip-user-mapping ip 172.21.8.195
IP address: 172.21.8.195
Ident. By: AD
Idle Timeout: 3581s
Max. TTL: 3581s
Groups that the user belongs to (used in policy)
Does anyone knows what could be happening?
Have you tried increasing the user Identification time out on the User ID agent. The main issue here is the Agent not the PAN. Try increasing the time out to 120 minutes and dis able the netbios probing and only enabling the WMI probing.
I tied it without success.
That is strange, why I get user ip-mapping throught CLI but it is only shown in some traffic logs. :smileyconfused:
During the time that the source user does not show in the traffic logs, are the users running a program that may require elevated privileges to Admin? If so, if you have the Admin user in the ignore list, for that one session of traffic when the user is running an application as an Admin, the username may not show.
The machines of these users are not in domain. That is the reason I used a script (obtain mapping from wireless controller) to send this mapping to the User-ID-Agent. Maybe these users use local admin account for some applications, but I have not configured admin ignoration.
Please add another snap shot of the traffic log that shows the either screen.. need to see if you are hitting the same rules for the users that are not be identified.
Also click on the detail icon.. Far left the one with the box and magnifying glass and add that snap shot too.
If you have time as well maybe calling into support will help so we can look at it closer.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!