Issue User-ID Agent some user mapping long time

[Pattarachai]

Hi Expert ,

I found issue about UIA which some user logon into network sometime IP   mapping user  long time or sometime not  mapping I must use clear user mapping and  every time and ip map user on AD  , I would like to know why user  mapping longtime or not mapping show unknow  however , I config cache  User Identification Timeout (min) 720 min already why long time 

[reaper]

hi @Pattarachai

could you elaborate on your configuration and the time you see users being identified ?

if you have userID cache enabled for 720 minutes, a mapping should remain for 12 hours at which time it is cleared

if a user is showing up as unknown you'll need to verify if the user exists on the UIDagent, and if the ActiveDirectory has a succesfull logon event in the event log

[Pattarachai]

HI @reaper

I try to use  cli  "clear user-cache ip (user issue) and found ip mapping user on AD  

[reaper]

you also need to clear the management plane cache

>clear user-cache-mp ip 

 this will remove all entries from the firewall, but as long as the user is still listed in the userIDagent, the firewall will simply re-fetch the info and repopulate it's cache

this article may help : https://live.paloaltonetworks.com/t5/Featured-Articles/Getting-Started-User-ID/ta-p/69321

[Pattarachai]

Hi @reaper

OK I got it about this thing but I don't understand  why I use this cli every time  

[reaper]

hi @Pattarachai

I'll need more information on what exactly you are trying to achieve as I'm uncertain at this point

Please provide more details about what you see and what should be different or you expect to happen

you should not be using that cli command every time (as it is a debug command), so what enticed you to start using it so frequently

you mentioned you have the timeout set to 720, what are your objectives? if users need to be cleared sooner, you should set the timeout lower

[Pattarachai]

Hi @reaper

Ok I will explain which before I use  PAN-OS 7.1.10 Model:3020 everything normally and later I have upgrade PAN-OS from 7.1.10 as 7.1.16 after upgrade found some user login on pc into a network via AD-User found issue IP doesn't mapping user and therefore use cli  debug command  

[Pattarachai]

Hi @reaper

As we to test again and forecasts whether about software issue because  UIA  mapping all user but when show user mapping on firewall with use " cli "show user ip-user-mapping ip (ip issue)"  is found not map show uknow but UIA mapping  and try to use "show log userid ip issue " found  UIA sending map I'm not sure user-id on firewall as issue or not