How does the firewall work when they received unknown-user's packet?

[JTR]

Hello, Guys. Nice to meet you.

I'm testing User-ID in PAN OS 4.1 and USER Agent 4.1.

There's something curious situation during my lab test.

I've deleted all ip-user-mapping information with 'clear user-cache all'.

So all users is unknown to firewall.

But the user agent still has ip-user mapping information using WMI probing.

In this case, I think the firewall should ask USER Agent  to get ip-user mapping information for the unknown user.

But the firewall can't get any information from the USER Agent, and the user still remains unknown.

and 'num of request of ip mapping msgs sent' doesn't increase.. only 'num of states msgs rcvd' and 'num of request of status msgs sent'

are increasing..

Does any one know why does firewall work like this ?

Thanks.

[rmonvon · Accepted solution]

Hi...For unknown users and new connections, the PA would query the userID agent to see if there is a ip-user mapping.  Because you manually clear the user-cache and there may be existing sessions, the cache may be populated as unknown.

I suggest you clear user-cache and also clear the session(s) via 'clear session all'.  Then generate new connection from that user IP to test.  Thanks.

[JTR]

Thanks, rmonvon, It works. But it took more time (about 10 sec) than I've expected. :smileygrin:

Anyway It was very useful , Thanks Again.