Session Clearing

[kaysun]

I have a PA-500 Firewall.  I am trying to test some policies, however, when I add and remove users from groups, the Palo Alto isn't picking this up fast enough.  Does anyone know the command line to clear out a session from the Palo Alto so it will re-check which group a user is in?

Thanks!

[sspringer · Accepted solution]

If you are running 4.1 you can use the following command to refresh group mappings

> debug user-id refresh group-mapping all

If you are still having problems you can try to clear groups and reset the connection to LDAP

> debug user-id clear group all

> debug user-id reset group-mapping all

I have seen some strange cases when changing user group information it is not populating correctly in LDAP. If you are still not seeing correct group information it may be worthwhile to use a LDAP browser such as Softerra to confirm the group information.

- Stefan

[kaysun]

I am running 4.1.  So if I type that directly in a command line the Palo Alto will re-check with LDAP to find out who is in what AD Security group?

[kaysun]

Worked awesome.  I can add and remove users from Windows groups and test exactly like I wanted.  thanks!!!