Cannot create rules based on users

[licenselu]

Hi,

I've installed a new PA-500 device. I've also installed the UID-Agent and it's communicating with the Palo Alto because:

"show user ip-user-mapping" return results with many users

on monitor tab I have the users displayed

on acc tab i also statistics with users

But when i want to create rules and add a user it doesn't show any user available.

[mikand]

You need to setup the LDAP aswell for the configuration to be able to see which users and groups you have.

[ppatel]

After setting up LDAP, please verify the presence of a functioning Group Mapping configuration under Device > User Identification > Group Mapping Settings

This configuration should contain a functioning LDAP server profile assigned to the relevant virtual system with available groups

Regards

Parth

[licenselu]

Normally it sould work without configuring the LDAP server.

I've many customer that haven't configured any LDAP server and it's working.

[ppatel]

In 4.1 user Id user to group mappings are performed using LDAP and the agent performs only user to ip mappings.

Try the following :-

admin@PA> debug user-id reset user-id-manager type all

admin@PA>configure

admin@PA#commit force

admin@PA#exit

admin@PA>debug software restart user-id

Wait for a minute and try to see if you can fetch the users in the security policy.

Regards

Parth

[licenselu]

I just need user to ip mapping so no need to configure LDAP Server.

I tried the following :

admin@PA> debug user-id reset user-id-manager type all

admin@PA>configure

admin@PA#commit force

admin@PA#exit

admin@PA>debug software restart user-id

but it didn't change anything.

I'll reboot the firewall in 30 minutes.

[licenselu]

The reboot didn't change anything.