IP to user mapping issues with Pan Agent

[hallk]

We run McAfee which does some user authentication on AD for group policies. The problem is that when this happens, the ip to user mapping shows this service account as the user instead of the actual user that is logged in. The actual user is then unable to match on a specific rule and therefore gets the incorerct access.

Not sure if changing some timers will help???

Note: Netbios/WMI probing is disabled

[James · Accepted solution]

Hi There,

You need to have this user ignored in the User-ID Agent:

https://live.paloaltonetworks.com/docs/DOC-1116

Thanks

James

[hallk]

Thanks James

Is there any command, or something else that you can run, to confirm whether this is working after the file has been created? Should you restart any services?

[gswcowboy]

Just to be on the safe side, you should restart the PAN-Agent service and reset the connection between the PAN device and the PAN-Agent.

> debug device-server reset pan-agent all

Traffic logs lacking the username in question would be indicative of it being resolved.

-Renato