10-16-2014 10:10 AM
I have a problem where the user id Agent is reporting the wrong user to an IP.
For example, user a is 10.1.1.5 and has id test1
Sometimes user b with an id of test 2 shows up with 10.1.1.5 which is not accurate, if I do a show user Ip mapping it shows test 1 is mapped to 10.1.1.5 and test 2 is mapped to a 10.2.2.5.
These are example IP's.
What is happening user A is being mis identified so blocked applications are allowed throught. If i show session ID on 10.1.1.5 for skype it shows user id test2, but all other Session IDS show test1 as the user.
10-16-2014 10:11 AM
Could you verify if there is any service running on that machine (10.1.1.5) that might be using the login of user test 2 ?
Also check the domain controller eventvwr security logs related to user test2.
10-16-2014 10:14 AM
I have 24 user id agents deployed in remote agents all reporting back to the firewall.
I only see user ID 2 on the firewall in the skype application traffic that I am trying to block to user ID1.
User ID 1 is in a totally different office location about 400 miles apart than user ID 2. User ID2 has never traveled and gotten an IP address from the User ID office location.
10-16-2014 04:58 PM
Even though the users are in different locations, It could be possible that the machine (10.1.1.5) is a shared resource that can be accessed from multiple locations by many users.
This could explain why the issue might be occurring with multiple users.
10-16-2014 05:24 PM
No that is not the case. Thanks.
10-29-2014 12:17 PM
very interesting, user-id not working properly only for Skype.
better to open a case I think.
10-29-2014 04:47 PM
10-29-2014 06:39 PM
Yes I have seen page 4, skype is using other clients as a proxy via the supernode option. I have a case open with support and not much success, this is why we abandoned the PALO for blocking skype and controlling it with group policy on the ad domain. This works better.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!