group mapping

[panos]

When we add a group from Active directory gorup list from Group mapping on Panos to right side of that window; it should come to the policy users tab.But sometimes it does not come for a time.Is there a way to refresh that or what is refresh  time for that, can we change it ?

[Abs]

Hi Bulent,

When you log in to the CLI and enter the show user group-mapping-service status command, what do you see?

A.

(Now shamelessly accepting the next 49 friend requests.)

[panos]

I see query number 2

and also local :2

but at policy ı see 1 group only.

I first saw this on customer site and tried on my lab and see the same thing.Both panos 5.0.2

[panos]

After some while(about 2 minutes) now it came 2 groups.

What affects this time ?I have to know that.

[Abs]

Device > User Identification > Group Mapping Settings > Choose the group mapping you've created.

There you will see the Update Interval. Adjust to your needs.

A.

(Now shamelessly accepting the following 15 friend requests.)

[panos]

I am choosing from there.But it comes late to policy.that is the problem.if interval is empty isn't it 60 seconds by default ?

[Abs]

No, the default interval when empty is 600 seconds (10 minutes).

[panos]

if the default is 600 seconds why do I see sometime in 2 minutes ?

[UhMayYeah]

The default update timer on group information, if left blank, is 600 seconds. You can change this interval by filling in a number between 60 and 86400 seconds

You can refresh the user-group-mapping by CLI commands :

> debug user-id refresh group-mapping all    ..... This command will fetch the only delta values or the difference.

> debug user-id reset group-mapping all     ...... This command will fetch the entire group mappings once again.

HTH..!

-AMEYA

[panos]

we tried these commands yesterday but it did not work.

Thanks.