Identifying user rules UserID

[soporteseguridad]

Hi,

We are expecting several issues with user identificatiom. We see connections identifying users but suddently the connections stop identifying. 

I attach an screenshot

[kiwi]

Hi @soporteseguridad,

It looks like users are losing their IP mapping.

Check this document : https://live.paloaltonetworks.com/t5/Management-Articles/Troubleshooting-User-ID-Group-and-User-to-I...

The section "IP mappings are created but disappear too soon" might help you on your way.

Cheers !

-Kim.

[soporteseguridad]

We are using SYSLOG in Palo to take the users. 

If we go into "show user ip-user-mapping all | match 10.162.246" we see that user: mcabr is identified correctly but going into traffic logs we see connections where mapping is lost.

(active)> show user ip-user-mapping all | match 10.162.246

10.162.246.22   vsys1  SYSLOG  mcab.in                 2353           2353              

10.162.246.20   vsys1  SYSLOG  mcab.in                 2406           2406            

10.162.246.23   vsys1  SYSLOG  mcab.in                1545           1545        

(active)> show user ip-user-mapping all | match 10.162.246.

10.162.246.23   vsys1  SYSLOG  mcab.in               1518           1518        

(active)> show clock

Wed Dec 28 09:24:07 CET 2016

[RFalconer]

Has this method of user-id ever worked correctly?

[Es_tecsupportsecurity]

im not sure. Palo alto uses syslog server for mappings......

[OtakarKlier]

Hello,

This is usually caused by the 'User Identification Timeout'. Happened to me a few times as well. If you are using agents, go into the setup and change the timeout value:

If you are using agentless, log into the PAN and change the value there:

Hope this helps.