User ID Agent

[markk96]

I have a problem where the user id Agent is reporting the wrong user to an IP.

For example, user a is 10.1.1.5 and has id test1

Sometimes user b with an id of test 2 shows up with 10.1.1.5 which is not accurate, if I do a show user Ip mapping it shows test 1 is mapped to 10.1.1.5 and test 2 is mapped to a 10.2.2.5.

These are example IP's.

What is happening user A is being mis identified so blocked applications are allowed throught.  If i show session ID on 10.1.1.5 for skype it shows user id test2, but all other Session IDS show test1 as the user.

[bat]

markk96

Could you verify if there is any service running on that machine (10.1.1.5) that might be using the login of user test 2 ?

Also check the domain controller eventvwr security logs related to user test2.

[markk96]

I have 24 user id agents deployed in remote agents all reporting back to the firewall.

I only see user ID 2 on the firewall in the skype application traffic that I am trying to block to user ID1.

User ID 1 is in a totally different office location about 400 miles apart than user ID 2.  User ID2 has never traveled and gotten an IP address from the User ID office location.

[markk96]

I will also say this is happening to multiple users.

[tshiv]

markk96,

Even though the users are in different locations, It could be possible that the machine (10.1.1.5) is a shared resource that can be accessed from multiple locations by many users.

This could explain why the issue might be occurring with multiple users.

Thanks

[markk96]

No that is not the case.  Thanks.

[panos]

have you fixed the issue ?

how many dc do you have ?

any agents are installed on dc ?

[markk96]

This is a problem with SKYPE and the way the Palo ID's users.

[panos]

very interesting, user-id not working properly only for Skype.

better to open a case I think.

[dburns]

Controlling Skype

See page 4.

[markk96]

Yes I have seen page 4, skype is using other clients as a proxy via the supernode option.  I have a case open with support and not much success, this is why we abandoned the PALO for blocking skype and controlling it with group policy on the ad domain.  This works better.