Hello,
I have some concerns regarding User-ID information. We currently have internal and external gateways which should be grabbing User-ID/IP mappings. These are critical for RBAC-style rules based on AD groups.
I notice sometimes that my logs have entries without a username. When this happens, my access is limited. I verified on the CLI that during this time, there is no mapping there either. Usually the mapping is restored after a few minuts thru no action of the admin/end user. I
started looking into things and realize that from the CLI, the source of my User-ID information is UIA and not GP. Is this expected? We are running agents on two Windows servers, as well as WMI with the Palo Alto agentless configuration. However, I had expected GP to sort of superscede both of these sources.
When looking at my GP client (currently connected inside the office), the username field is blank. Is this expected? Is it indicative of an issue? I'm unsure if this is related to the log entries showing no username (since things work right now and the logs are fine) but I'm trying to validate the stability of our User-ID information-gathering. The CLI has UIA and all my groups, so it's accurate but I'm unclear why it isn't the type GP.
I guess to summarize, I have 2 questions:
1. Has anyone seen the mapping disappear temporarily?
2. Is the source 'UIA' expected considering my situation?
The first screenshot shows the lack of username in the GP client. The second screenshot shows the issue where several lines of the log contain no username (note: it's a little hard to see and there's no deny entries because this rule does not specify one, but the rules that do are not hit when the username is not present).
Thank you
Edit: I did some testing
I switched to wireless and then disabled GP. I then re-connected to the wired network and did a DHCP release/renew. I waited a few minuts but no mapping appeared in the CLI. I then re-connected GP internally and the user name field now displays the correct username and the CLI showed type GP. However, after a minute it switched back to UIA.
I don't understand why the mapping did not exist when GP was disconnected. I also do not understand why it changed back to UIA from GP after a minute or so.
I'm running GP 4.1.7 for reference
