Agentless UserID no longer maps users

[ClintL]

Hello all,

I've had Agentless UserID working fine for over a year now.  Last week our PA-3020 running 6.0.3 stopped being able to identify users which it then started blocking all Internet browsing because it thought everyone was unauthenticated.  Nothing has changed on the firewall and to my knowledge nothing has changed on our AD servers.  The weird thing is I can still log into the firewall with my AD user account just fine.  I opened a ticket with Palo Alto and the tech confirmed that all my settings are correct.  The service account we use to access WMI is not locked out and I even reset the password just to be safe.  The AD servers (2008) show connected but when you run a "show user ip-user-mapping all" it returns no results.  I see no errors on the Palo and the Event Logs on the servers don't show anything that stands out.  Has anyone run into this before?  Palo tech support is basically stumped as am I.  The only thing I haven't done is reboot the Palo but I that is something I have to schedule downtime for.

[bmorris1 · Accepted solution]

Hey ClintL,

How long has the box been up for? It is likely that you have encountered the 388 days uptime bug by the looks of it so you should upgrade your device. The fix is in 6.0.4. I recommend contacting your ASC for advice.

thanks,

Ben

[ClintL]

You nailed the exact uptime date when this started.  I have an upgrade scheduled for next week so hopefully it will resolve the issue.  Thank you for the answer!

[ACortes]

You might reboot the units and the counter start again. You have another 388 days before upgrade or reboot