PAN-OS User-ID Issue and Workaround

[bschaper]

I upgraded to PAN-OS 10.0 yesterday and encountered an unusual bug when pushing out a config to my 3220.  I opened a case, but figured I would post it here as well, but don't expect screenshots.

Symptom:

After the Panorama upgrade a commit to the 3220 was giving the following error:

Need to config WMI account and password for querying Microsoft directory servers

If I switch to WinRM-HTTP(s) I got similar error but referring to missing dns name.

Observations:

After some digging and after verifying I was not crazy and Panorama had the username, password and domain name, I removed the server monitors and was able to push a config.  A quick look on the firewall I noticed that the server monitoring account as empty, and appears that panorama is not pushing the settings correctly.  Firewalls run 9.1.3 currently.

Workaround: 

To resolve the issue, I overrode the User-ID settings on the firewall and added the account info, and just have Panorama pushing the the servers to monitor.  This resolved the issue in my case, but does leave that overrode setting that still needs to be addressed.

Hopefully this helps somebody in case you have the same problem, or if you have another solution to fix the override I would like to hear that.

[AgilysysNetOps]

We upgraded to 10.0.8 as per TAC suggestion but still getting same error while commit from panorama, then they given below work around , yet to try.

From panorama cli , get into configure mode and try to execute below command, please note in below command change template name to one in concern and execute it .after command is successful, try to commit same and push .

delete template <template name> config vsys vsys1 user-id-collector setting


Move the template which has the user-id configuration on top of the template stack.

After performing above two steps , it should work

[jdeboer04]

I know your comment is a few months old but wanted to respond anyway.  We've had this issue for months and just recently found a workaround that is working for us.  We started on 9.1.11 software on our 7080's, went to 9.1.13-h1 successfully.  From there we attempted to go to 10.0.0 and noticed that the auto commits were failing not allowing the device to complete the boot up and become functional.  All we've done is exported a device state when we're in the 9.1.13-h1 software, and then imported it after the 10.0.0 upgrade.  From there a few times we've had to enter the username and password for the WMI account, then CLI and force a commit.

[MatthewRoberts]

I am still experiencing this issue on a brand new panorama install version 10.2.2-h1.

I have tried all of the workarounds as mentioned in this thread however can not get the User-ID configuration onto the firewalls. I have found the config impacted for me under the User-Identification menu is only three areas , Palo Alto Networks User-ID Agent Setup, Connection Security and Authentication Portal Settings. All other configurations under User-Identification I can apply with no issues to my firewalls from panorama.

Palo support are yet to find a fix. I have identical config in another panorama instance running 9.1.13 and have no issues.

I am unable to override via CLI on the local firewalls as when I enter the settings locally using override commands they are there and commit fine with no errors but not active. The xml export also shows config on local firewalls but it appears to do nothing.

Hopefully support can figure this out else we may need to use the windows user-id agent or wait for their new Cloud Identity Engine to support users.