Data plane User-ID mappings empty

[SpydersSupport]

We currently have a pair 5020s using LDAP for User-ID - up until about a week ago it was working.

I can see in the logs that the mappings are taking place, and the management plane mappings are there, however the data plane table is empty.

This is causing drops on policies which have User-ID as a stipulation.

Any ideas?

[pulukas]

I don't see anything on this issue specifically, so here are some general thoughts.

Sounds like a bug.  So I would make a quick search of the latest release notes for your PanOS chain and see if this is listed as a solved issue in a release higher than what you are running.  If so, then upgrade.  If not, open a ticket to get this registered as a bug and into the release chain.

For a quick fix on issues like this a restart of the management plane will sometimes restore service.

debug software restart management-server

[mivaldi · Accepted solution]

What PAN-OS version are you running and what is the Active device's uptime ?

Based on your description, I suspect Bug 64166, resolved in PAN-OS 6.0.4 and 5.0.14.

[pulukas]

Thanks for doing the bug search and providing the ID.

[SpydersSupport]

Thanks guys, that bug looks exactly like the issue - we're running 6.0.2 with 400 days of update as of this morning.

We'll get'er upgraded and I'll shoot back if it doesn't resolve it but I have a feeling it will.