About updating AD group membership

[RohJaewoong]

Hello guys

1. I configured LDAP profile and update from AD DC

2. AD group named domain-users has about 10900 user

3. Customer created new user and applied new user to domain-users group

So I tried to refresh a group-mapping information by debug command. But PAN could not be updated domain-users group information and refreshing member of group.

1. I created new group and applied new user to new group

PAN could be updated and bring a new-group with their membership.

So I have a question. How many PAN recognize a group-member from AD? or PAN has got a limit of max group membership from AD?

Thanks in advance.

Regards,

Roh

[hshah]

Hi Roh,

By default existing group mapping is updated after 1 hour, you can change the settings. Please refer bellow mentioned document for more details.

https://live.paloaltonetworks.com/docs/DOC-4994

Let me know if you have further questions.

Regards,

Hardik Shah

[hshah]

You can force group-mapping refresh with following command.

https://live.paloaltonetworks.com/docs/DOC-3294

[HITSSEC]

Roh,

We have a domain with 10,000 - 12,000 accounts in the domain with no issues. We have user-id agents on two servers (redundancy) polling 12 domains across a total of 39 Domain controllers without issue.  Keeping in mind the group membership polling interval mentioned above in the previous posts.  The polling interval is a balancing act between performance hit on the servers vs. speed of updating changes to group membership. We will add the user to the rule and commit if there is an urgency to the access request while waiting for the polling interval to update the firewall with the group membership changes (usually an addition).

Phil

[Gregoux]

hello

you could find more information here

https://live.paloaltonetworks.com/docs/DOC-5939

greg