Upgraded to 5.0.9 ? User Identification stops working?

[paulmeys]

Hi,

I had 2 PA's running with user-identification using the user-id-agent.

Both have the same config, running 5.0.7

I upgraded both to 5.0.9

one is working fine, the other one does not "see" the user anymore.

Tried the normal stuff: reboot, reinstall, tried 5.0.8 ( same problem ), checked the user-id-agent (connected), ...

When I revert to 5.0.7, everything is fine again.

Anyone seeing the same behavior ?

Thanks,

Kind regards,

Paul

[HITSSEC]

Paul,

We have not seen the issue.  We went from 5.0.7 to 5.0.8 to 5.0.9 without seeing any issues relating to the user identification.  We have 2 PAs in an Active/Passive config.  We point the PA to two different servers running the user-id agent version 5.0.6-6.

Have you tried updating the User-id agent if not on 5.0.6-6?

Phil

[dpalani]

Hello Paul,

Based on your explanation, it looks like a config migration issue. Following command will show if the firewall is connected to the user id agent "debug management-server conn", if the connection to the user id agent is seen, check for the stats with

"show user user-id-agent statistics". If these two tests fail. Reconfigure the user id agent on the firewall.

Regards,

Deepak

[SimmSimm]

I found when updating to 5.0.9 from 4.1.x that some old rules for excluding networks from user id scanning (Network tab -> Zones) reappeared in some strange way - at the time I put it down to me being a bit far fingered, but maybe this applies in your case too ?