nt-autorität\anonymous-anmeldung

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

nt-autorität\anonymous-anmeldung

L2 Linker

Hello Guys,
I have sometimes a problem with the user identification on the PA500. Our Users can only browse the internet with your AD-User. Sometime the User is lost on the PA. The User "nt-autorität\anonymous-anmeldung" is used? Why? How can I find a solution?

 

Thanks

 

cu
Wolfgang

1 accepted solution

Accepted Solutions

Hi,

I think the solution is/was to store the ignore_user_list.txt as UniCode!!!

 

Thanks to all

 

cu

Wolfgang

View solution in original post

18 REPLIES 18

L4 Transporter

You should exclude this user from user id by adding him to the ignore user list.

As far as I know, this user is for anonymous accessing e.g. printers or shares if configured.

Best Regards
Chacko

Hi Chacko42,

I had this done...but it's not the solution 😞

 

Palo.jpg

 

Any other Idea?

 

Thanks

 

cu

Wolfgang

Do you receive user-id updates only by using the integrated agent or are there other sources as well?

I assume you can see this user-mapping in current traffic logs? Are these current sessions or older ones?
Can you see the user by querying "show user ip-user-mapping all" on your FW?

Best Regards
Chacko

@w.naderer

Do you have netbios probing enabled on the user id agent?

We have installed the Palo Agents on our Active Directory Controller.
Yes, the User is switching automatically from userid into nt\authority... in the current traffic log.

How can I do the command?

 

Thanks

 

cu

Wolfgang

Alright, there is the problem.

The setting in the web UI is only for the agentless User-ID (FW polls DCs directly).

 

You need to define the ignore-users on the user-id agent on your ADC by creating a file

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/configure-user-mapping-using... (search for ignore)

Best Regards
Chacko

the ignore list needs to be on the agent on the AD controller, adding the ignore user list on the firewall may only exclude it from locally learned user-ID

 

you'll need to add "ignore_user_list.txt" in the User-ID install directory, then add the name to the text file

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Netbios Probing is YES and the interval is 20 minutes

 

I also implemented the ignore list on the ADC

user.jpg

 

Thanks

 

cu

Wolfgang

Hi,

Which settings play a role in the comparison?
Can I evaluate something on the User-ID-Agent or does it make sense to delete such entries manually?

 

Thank you

 

Cu

Wolfgang

You should try to determine who/what is adding those entries to the firewall user-ip list

 

If you go into the monitor tab on the UserID agent, is the anonymous-anmeldung user still listed there?

if this is the case, you could try tuning the entries in your exlude_user_list.txt, possibly try restarting the uid service in case it isn't picking up the file

 

if the user does not exist on the agent, it must originate from somewhere else, possibly the clientless config on the firewall or a different agent

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Good morning Reaper,

Yes the "anonymous.." is listing into the monitor tab!

I delete the entry and the right user was shown.

But was is the reason with the anonymous entries? What can I do?

 

Thanks

 

cu

Wolfgang

Hello together,

Is it useful to change the parameter "User Identification Timeout" Value?

 

Thanks

 

cu

Wolfgang

Could you try to disable Netbios probing?

I did it - some nt-autorität\anonymous-anmeldung entries are still in the log 😞

 

Other parameters?

Any other ideas?

 

THANK YOU

 

cu

Wolfgang

  • 1 accepted solution
  • 7430 Views
  • 18 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!