PA-5050, Agent-less user-id to AD, exclusions not working?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

PA-5050, Agent-less user-id to AD, exclusions not working?

L1 Bithead

Working on setting up a 5050 with user-id mapping against 2 domain controllers.  the agent-less, WMI based setup is working fine thus far, except I cant figure out how to exclude certain IP ranges.

For instance.  We have a VPN appliance that does Kerberos authentication to the AD Domain.  Everytime a user logs in, it associates the IP of the device requesting authentication as a user-id map.  Id like to just exclude that device from ever being learned.  Along with the domain controllers and some other servers themselves.

I have tried a few different include/excludes on all the zones with UID turned on, but it doesnt seem to stop those IPs from being learned.

PanOS 5.0.2


Accepted Solutions

Its working.  The addresses were coming back after I cleared the cache.  I just had to wait it out.  Just impatient.  Sorry for the bum question!

View solution in original post


L5 Sessionator

You can use the Include/Exclude Networks section to ignore mapping for certain networks:


I tried that.  But that makes it so the mapping isnt learned from the AD servers themselves.

Example.  AD Servers at and  I dont want to learn who is logged onto the AD servers, or any other server in the subnet.  Only clients in another subnet.  I put exclude in that list and then NOTHING gets learned except the IPs from RADIUS accounting.  Just seems like it is malfunctioning somehow.

EDIT:  IIRC, that made it so it wouldnt discover the AD servers themselves.  Because the servers in the box above disappeared shortly afterwards.

EDIT2:  To clarify.  If I have and AD servers and other misc servers or appliances at  I do not want a username to ever be associated with IPs,,

L1 Bithead

Looking to ignore IPs, not users.  Certain IPs I dont want to ever be associated with a user.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!