User Groups Seen as Users in Security Policy and new users added to that group are not getting identified.

[Gururaj]

Hi All,

Model- 2050  and PANOS- 5.0.6

In security policies groups are showed as a single user and any new user added to that group are not getting identified by the PaloAlto firewall. In source user column in policy showing single user icon instead group icon. But existing users in group are getting identified ( this issue is only for newly added users )

I verified using below commands and it seems everything is fine.

#show rulebase security rules test_rule          -----Showed source user as "xyz\test_group" ( group which i have used in security policy )

>show user group name xyz\test_group          ------Showed all the users in that group including newly added users.

>debug user-id refresh group mapping all       -------- Given message that refresh is successful.

But still device is not identifying those newly added users in group   ( still showing single user icon in source user column )

regards,

Gururaj

[tasonibare]

Gururaj,

How are you configuring the group in the security policy? Do you get a drop down list of groups or you manually enter the group information?

If you are manually adding the group in security policy, try adding the long format (cn=test_group,ou=xyz...) and see if that makes a difference.

You might also want to try resetting the group mapping as well:

> debug user-id reset group-mapping all

Regards,

tasonibare

[Gururaj]

Hi tasoni,

Thank you for suggestion,..

Yes, i have selected group from drop down list.

I have tried by refreshing the group-mapping

OK, let me to check it by resetting group-mapping

Regards,

Gururaj

[cfnavarra]

You could try to re-establish the mapping when the problem occurs.

#debug software restart user-id

[dpalani]

Try adding the distinguished name of the group in the security policy, the firewall will identify the short name and populate it automatically with the correct group icon.

Deepak