Unable to delete users sessions on the firewalls (using Panorama API or FW cli) that managed by Panorama when the client=Panorama

[NirI]

Hi Everyone,
We have a problem when we try to close/delete user session on the firewalls managed by Panorama
We have multiple FWs under Panorama

Issue:
Unable to close Admin (or any user) session (i.e. delete) as Panorama client on the managed Firewalls.
The same status using Panorama API, for example:
https://<Panorama_IP>/api/?type=op&cmd=<delete><admin-sessions><username>User_Name</username></admin-sessions></delete>&target=<FW_SerialNumber>
or
Using FW cli (direct cmd)
The operation succeeds according to response message but Panorama session as client with user name on the FWs are not deleted as expected.
for example we got the following message:

<response status="success">

    <result>User1 administrative session deleted</result>

</response>

But the session is not being deleted at all, the same behavior using the FW directly via CLI 

Platforms:
Panorama (VM, v10.1.0)

Managed FWs:
VM-(v10.0.0)
VM-(cluster1, v10.1.0)
VM-(cluster1, v10.1.0)

VM-(cluster2, v10.0.0)
VM-(clsuter2, v10.0.0)

Is there anyone who can help in this matter?

Thanks

[panos]

Hi,

I have same issue and on dashboard I see huge list of sessions from same user related to Panorama.

I can only restart management-server to clear them but I need another solution.

Regards

[JimmyHolland]

Hi @NirI, if you get a message that the CLI or API command succeeded, but the operation didn't actually work, that is something TAC needs to investigate. Please raise a ticket via your usual method (direct with Palo Alto Networks, or via your reseller if applicable).

Hi @panos, same as above regarding the CLI/API command not working. But if your query is more around expiring the stale administrator sessions in general, consider using the "Idle Timeout" feature found under the "Authentication Settings" in "Device > Setup > Management" and/or "Panorama > Setup > Management". Ref: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/device/device-setup-manageme...

[panos]

Hi,

idle timeout unfortunately does not clear these sessions.Already tried that.

Regards

[JimmyHolland]

Hi @panos, it should do, maybe there is something stopping the idle timeout being reached. Again, that sounds like something not working as expected so the best way to proceed is to get Support/TAC to assist you.

[NirI]

Thanks Jimmy, 
Is it possible to let someone to do small check internally and get confirmation about the issue ?

Br,

[JimmyHolland]

If you can give me the exact details of what you want checking, I will see what is feasible

[NirI]

Yes please, the scenario as follows,
To check if the following API is working or not, i mean if the session is closed in actual, even if the response is success:

<response status="success">

    <result>User1 administrative session deleted</result>

</response>

in our VM machines(Panorama and FWs) it's not working, success but the session is not deleted at all:
The User_Name should be used by Panorama as console on the target firewall, i.e. in target firewall: Dashboard > Logged in Admin window 
Admin=User_Name and Client=Panorama, it's kind of opened session by Panorama itself on the managed FW by User_Name

https://<Panorama_IP>/api/?type=op&cmd=<delete><admin-sessions><username>User_Name</username></admin-sessions></delete>&target=<FW_SerialNumber>

Thank you!

[JimmyHolland]

Hi @NirI, I used this in Postman:

https://{{host}}/api/?key={{key}}&type=op&cmd=<delete><admin-sessions><username>{{admin-username}}</username></admin-sessions></delete>&target={{ngfw-serial-number}}

It deleted the direct SSH and web GUI sessions for {{admin-username}} on {{ngfw-serial-number}} (SSH session shown in screenshot):

 

The Panorama context-switch session (which is what you're describing when you see admin={{admin-username}}, from=console, client=Panorama in the sessions list on the firewall) was also cleared, and I got this in the browser when I refreshed the screen of the context-switched sessions, showing my context-switched session to the firewall was now invalid, and I only had the option to switch back to Panorama:

All my testing was done with 10.1.2. on Panorama and firewall. 

Hope that helps.

[beng]

@NirI - wondering if this was fixed for you in v10.1.2 or above by any chance?

@JimmyHolland - thanks for the example - very easy to walk through that one.

For me, I'm using Panorama v10.0.8-h8 and a VM-300 v10.0.5 and experiencing the same issues @NirI was last year. There was also an upgrade done on Panorama either late December or early January also, so I'm a bit confused as to why the idle sessions are still in place prior to the upgrade.

Also, I've tried just putting in random non-existing usernames into the command line or API, and found that the command seems to accept and work, however no actual user exists. e.g.

admin@NGFW> delete admin-sessions username this-user-does-not-exist

this-user-does-not-exist administrative session deleted

admin@NGFW>

I've got a TAC case open where I think the TAC engineer has advised he is checking with his internal colleagues. Wondering if anyone in the community has also seen this kind of behaviour/behavior?