nt-autorität\anonymous-anmeldung

[w.naderer]

Hello Guys,
I have sometimes a problem with the user identification on the PA500. Our Users can only browse the internet with your AD-User. Sometime the User is lost on the PA. The User "nt-autorität\anonymous-anmeldung" is used? Why? How can I find a solution?

Thanks

cu
Wolfgang

[Chacko42]

You should exclude this user from user id by adding him to the ignore user list.

As far as I know, this user is for anonymous accessing e.g. printers or shares if configured.

[w.naderer]

Hi Chacko42,

I had this done...but it's not the solution 😞

Any other Idea?

Thanks

cu

Wolfgang

[Chacko42]

Do you receive user-id updates only by using the integrated agent or are there other sources as well?

I assume you can see this user-mapping in current traffic logs? Are these current sessions or older ones?
Can you see the user by querying "show user ip-user-mapping all" on your FW?

[Remo]

@w.naderer

Do you have netbios probing enabled on the user id agent?

[w.naderer]

We have installed the Palo Agents on our Active Directory Controller.
Yes, the User is switching automatically from userid into nt\authority... in the current traffic log.

How can I do the command?

Thanks

cu

Wolfgang

[Chacko42]

Alright, there is the problem.

The setting in the web UI is only for the agentless User-ID (FW polls DCs directly).

You need to define the ignore-users on the user-id agent on your ADC by creating a file

https://www.paloaltonetworks.com/documentation/71/pan-os/pan-os/user-id/configure-user-mapping-using... (search for ignore)

[reaper]

the ignore list needs to be on the agent on the AD controller, adding the ignore user list on the firewall may only exclude it from locally learned user-ID

you'll need to add "ignore_user_list.txt" in the User-ID install directory, then add the name to the text file

[w.naderer]

Netbios Probing is YES and the interval is 20 minutes

I also implemented the ignore list on the ADC

Thanks

cu

Wolfgang

[w.naderer]

Hi,

Which settings play a role in the comparison?
Can I evaluate something on the User-ID-Agent or does it make sense to delete such entries manually?

Thank you

Cu

Wolfgang

[reaper]

You should try to determine who/what is adding those entries to the firewall user-ip list

If you go into the monitor tab on the UserID agent, is the anonymous-anmeldung user still listed there?

if this is the case, you could try tuning the entries in your exlude_user_list.txt, possibly try restarting the uid service in case it isn't picking up the file

if the user does not exist on the agent, it must originate from somewhere else, possibly the clientless config on the firewall or a different agent

[w.naderer]

Good morning Reaper,

Yes the "anonymous.." is listing into the monitor tab!

I delete the entry and the right user was shown.

But was is the reason with the anonymous entries? What can I do?

Thanks

cu

Wolfgang

[w.naderer]

Hello together,

Is it useful to change the parameter "User Identification Timeout" Value?

Thanks

cu

Wolfgang

[Remo]

Could you try to disable Netbios probing?

[w.naderer]

I did it - some nt-autorität\anonymous-anmeldung entries are still in the log 😞

Other parameters?

Any other ideas?

THANK YOU

cu

Wolfgang