IP to User Mapping Error

[mbs.admin]

Hi,

I'm having problems in resolving IP address to usernames. PA2050 is integrated with active directory to resolve IP address to usernames. We also create security policies based on usernames. This configuration works great in version 3.1.6 but after the upgrade to version 4.1.4 we encountered errors. Some IP addresses are unable to resolve to their corresponding usernames. So, the policy that should be applied for specific users are ineffective.

Please help.

Thanks,

Rex

[u10723]

have you upgraded your user-id agent - with the user-id changes in 4.x the user-id agent version should match your PAN-OS version.

[mbs.admin]

Hi ITS,

The version of PAN-OS and PAN Agent are already ver4.1.4 but still same problem. I also notice that sometimes the usernames were resolved and sometimes not, it's intermittent. Has anyone experience this before?

Thanks.

[jseals]

Hello,

There could really be a lot of causes for this. First, I'd look over this very useful document if you haven't already.

https://live.paloaltonetworks.com/docs/DOC-2019

It goes over the needed steps when upgrading the agent like you've done.

After all of that is veriifed and looks okay, get a ssh session on the firewall and run:

> show user ip-user-mapping all

If you don't see any mappings there, goto the UID agent on your Windows server and see if it has any mappings. It's important to know where the lack of mappings is happening at for troubleshooting.

Thanks,

Jason