USER-ID XML API Include Network

[rats]

Hi,

I'm using two PA-850 in HA, Software Version 8.1.21

For our Wifi, we have a Clearpass server sending XML-API commands to our PaloAlto, to do IP/User Mapping, but the mapping doesn't work.

If I try to call the API directly (using https://myfirewall.com/api), I can send commands this way, and see the result.

Sending In API-> User-id this xml command, to login :

<uid-message>
<version>2.0</version>
<type>update</type>
<payload>
<login>
<entry name="MyDomain\user" ip="10.0.1.1" timeout="0"/>
</login>
</payload>
</uid-message>

I get this Error in return :

<response status="error">
<msg>
<line>
<uid-response>
<version>2.0</version>
<payload>
<login>
<entry name="MyDomain\user" ip="10.0.1.1" message="IP 10.0.1.1 is not in include network"/>
</login>
</payload>
</uid-response>
</line>
</msg>
</response>

While This IP is clearly in a Zone where User-Id is enabled.

For a user already logged (by ActiveDirectory, via the User Agent)
If I try a Logout command :

<uid-message>
<version>2.0</version>
<type>update</type>
<payload>
<logout>
<entry name="MyDomain\User" ip="10.0.1.12"/>
</logout>
</payload>
</uid-message>

No problem, I get this answer :

<response status="success">
<result>
<uid-response>
<version>2.0</version>
<payload>
<logout> </logout>
</payload>
</uid-response>
</result>
</response>

So, did I miss something in my settings, or could this be a bug ?
And If so, should I update to a latest version ?

Thanks by advance for your answers.

Michael

[JimmyHolland]

Hi @rats, the error refers to the "include network" and says 10.0.1.1 is not within this network. How is your include/exclude configured at the moment?

 

 

[rats]

Hi Jimmy, 

Thanks for your response.

I have only a subnetwork In exclude mode, nothing else.

[JimmyHolland]

Hi @rats, if the IP address you are trying to register is outside of the exclude network(s), and/or inside of the include networks, as defined in the User-ID settings and the zone settings too (they also have include/exclude configuration) then this is not expected behaviour. I would suggest raising a case/ticket to have this investigated further, as sharing more details of your specific configuration in a public forum is not advised.

[rats]

Hi Jimmy, 

I'll raise a ticket for this issue, thanks the answers.

Michael