IP Mappings Disappear Too Soon in log

[vesna.djukic]

Hi,

We have two PA-3020 in HA state, PAN-OS is 5.0.4 and we have configured 4 User-ID Agents (for now, in this troubleshoot stage, we are focused on only one agent).

Problem is in IP – user mapping. Sometimes in logs we see user and in very next moment the field for username is blank. The problem is equivalent with section IP Mappings are Created but Disappear Too Soon from Troubleshooting User-ID: Group and User-to-IP Mapping. We checked the potential causes of the problem described in this article, but everything mentioned in it is working correct.

We don’t see any users in DP on firewall:

----------------(active)> show user ip-user-mapping all option count

Total: 0 users

and on MP we have:

----------------(active)> show user ip-user-mapping-mp all option count

Total: 602 users

Don’t know if this means anything, but the same inputs on passive device are showing:

----------------(passive)> show user ip-user-mapping-mp all option count

Total: 0 users

----------------(passive)> show user ip-user-mapping all option count

Total: 28 users

What is the difference within mapping on DP and MP? Could it be reason for IP mappings disappear too soon? Do you have any idea?

We have a plan to make passive device active to see if anything is different, but system is big and playing with active/passive states is not option for now…

Thank you very much!

Best regards,

Vesna.

[ssharma]

Hi vesna.djukic ,

Can you run "show system info" and verify if the device's uptime is 388 days or more ? Thank you.

[vesna.djukic]

Hi ssharma,

uptime: 594 days..

I saw this topic https://live.paloaltonetworks.com/message/45961#45961 but I was sure that uptime isn't so long.. Do you think that this could be the same issue?

Thank you!

[ssharma · Accepted solution]

Yes, we have known issue Issue # 64166. Which is fixed in version 5.0.14 and later and 6.0.4 and later.

Since mapping is lost from data-plane that might definitely be the case. Workaround is to reboot the device and upgrade for permanent fix. Hope this helps. Thank you.

[vesna.djukic]

Great!! We will reboot the device and post here a feedback.

Thank you once again!

BR,

Vesna.

[vesna.djukic]

Reboot helped. ssharma, thank you once again.

Btw, does anyone know why exactly 388 days are causing the bug.

[sbabu]

Hi Vesna,

The issue is total time "Time data-plane was up + User Time-out" cannot be greater than 388 days(2^25).

This is because the absolute time-out has 25 bits in data structure, This increased to 27 bits in 6.0.4 and later versions and it fixed this issue.

Regards,

Sarath