PAN agent Group cache on PAN

[helenio.sartori]

Hello, I'm using PAN OS 3.0.5 and doing

> debug device-server dump user-group name

followed b the tab I'm seing very old group that are not anymore in the Filter group member of the pan-agent. It seams that the PAN have cached the olds user/group relation. There is the way to force a clear of the group <-> user relation on the PAN FW ?

[swhyte]

You can clear the cache for this information with the following commands:

> debug dataplane reset user-cache
   > all   Reset all ip to user cache in data plane
   > ip    Reset the specified ip to user cache in data plane

thanks,

Stephen

[helenio.sartori]

The command above seams the delete only ip <-> user mapping.

I'd like to delete user <-> group mapping that seams to be still on chache cause I see very old group that I'm not using since month.

command -> debug device-server dump user-group name

[James]

The "Stale" content could be coming from the UIA.  You can check this by looking at the cache files in the UIA Installation Directory - typically under "Program Files".

Regards

James

[lwheelock]

What about on 4.x.x versions where the group information comes from the Firewall itself?

[jseals]

You can clear the group cache on 4.1.x by doing the following:

> debug user-id clear group all

You can then force a group refresh:

> debug user-id refresh group-mapping all

-Jason

[lwheelock]

Thank you, that was what I needed.

[forfarj]

Exactly the answer I was looking for to address my issue.  I had duplicated groups listed from the PANuserAgent after installing the new USERIDagent and it was causing issues with classification.  Clearing out the groups and refreshing them fixed the issue.

Justin