How often the Palo Alto LDAP group members get sync if membership changes ?

[ksingh1980]

How often the Palo Alto LDAP group members get sync if membership changes?

If I add few more users into the group in LDAP after two weeks, it is configured on PA to block the sites, will it sync with LDAP groups?

[aleksandar.astardzhiev]

Hi @ksingh1980 ,

If I understand your question correctly you are asking about the "Update Interval" for the Group Mapping, correct?

Interval depends on what you have configured - https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/user-identification/device-us...

If I recall correctly the default value is one hour (3600sec). This means that by default every hour FW will generate LDAP query to get user groups from the Active Directory.

If you add user to group you need to wait for that interval for the firewall to get the update. You can configure short interval, or you can manually force the firewall to sync the user groups, right now:

> debug user-id refresh group-mapping

[S.Cantwell]

Hello again

The interval for LDAP updates is 60 secs.. vs 60 minutes... as shown in the UserID group mapping area.

[BPry]

@S.Cantwell,

Right, what @aleksandar.astardzhiev correctly pointed out is that by default the Update Interval for group-mapping is set to 3600 seconds which is 60 minutes. While you absolutely can set it up to update every 60 seconds, by default the firewall is only updating group membership every 3600 seconds.