I had 2 PA's running with user-identification using the user-id-agent.
Both have the same config, running 5.0.7
I upgraded both to 5.0.9
one is working fine, the other one does not "see" the user anymore.
Tried the normal stuff: reboot, reinstall, tried 5.0.8 ( same problem ), checked the user-id-agent (connected), ...
When I revert to 5.0.7, everything is fine again.
Anyone seeing the same behavior ?
We have not seen the issue. We went from 5.0.7 to 5.0.8 to 5.0.9 without seeing any issues relating to the user identification. We have 2 PAs in an Active/Passive config. We point the PA to two different servers running the user-id agent version 5.0.6-6.
Have you tried updating the User-id agent if not on 5.0.6-6?
Based on your explanation, it looks like a config migration issue. Following command will show if the firewall is connected to the user id agent "debug management-server conn", if the connection to the user id agent is seen, check for the stats with
"show user user-id-agent statistics". If these two tests fail. Reconfigure the user id agent on the firewall.
I found when updating to 5.0.9 from 4.1.x that some old rules for excluding networks from user id scanning (Network tab -> Zones) reappeared in some strange way - at the time I put it down to me being a bit far fingered, but maybe this applies in your case too ?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!