Loosing USER-ID

Reply
Highlighted
L4 Transporter

Loosing USER-ID

Our AD based USER-ID seems to keep loosing the IP/USER  association.

 

We only have a few rules which work some of the time and then fail with a blank user.

 

What's the best solution to get it 100%???

 

Rob


Accepted Solutions
Highlighted
L7 Applicator

Re: Loosing USER-ID

is your user id timeout set to the default 45 mins.

 

just set it to either 4 hours or 8 hours (mins equiv)

 

I have mine set to 24 hours...  

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: Loosing USER-ID

is your user id timeout set to the default 45 mins.

 

just set it to either 4 hours or 8 hours (mins equiv)

 

I have mine set to 24 hours...  

View solution in original post

Highlighted
L4 Transporter

Re: Loosing USER-ID

Yes 45 mins.

 

Do new users logins on the same system get picked up ok with that setting of 24Hrs?

 

Cheers

 

 

Rob

 

Highlighted
L7 Applicator

Re: Loosing USER-ID

Rob, not sure what you are asking.  but yes..

 

although the timeout setting is global to all users, it is not a global timer...

 

so each user, as they authenticate with AD will start there own 24 hour timer for there own mapping.

 

i think existing mappings will only pick up the new timeout on next authentication.

 

24 hour is overkill, i only have it as we aslo use Network Access Control on our switches.

 

4 hours is good practice as usualyy stop for lunch, (lock laptop) 8 hours is a safer bet.

 

the other option is to use mapping against email server or similar. whatever has the most activity..

 

 

Highlighted
L7 Applicator

Re: Loosing USER-ID

 please note that if an old mapping exists from earlier and your scope runs out of IP addresses then a non AD user could obtain an address of an old mapping prior to it timing out, probably didn't explain that very well, post back if you neeed more info.

Highlighted
L0 Member

Re: Loosing USER-ID

@MickBall I like it how you said 4hrs or 8hrs is safer bet.We use WMI probing.The current timeout we have now set is 10hrs. The probe time is set to 20min.

 

At our company as all of has work from home situation users are jumping on and off the VPN to avoid latency with Zoom/Webex or bypass the FW rules or whatever. Because of this, the IP addresses becomes free and the new user logging onto Pulse gets them.The firewall hasn't reached its 10hour period and the new user gets the old user's User ID and the new user happened to be an executive and gets the block page. 

 

What is the ideal way to resolve such issues when the IPs are so frequently changed, default of 45min? But what happens if something chnages in that 45min time period? Is there more real time information for firewall somehow? 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!