User-ID - one user occasionally not hitting the user based policy

[nikoo]

PAN-OS 8.1.2, User-ID configured with Windows AD single domain. There are security rules built, based on users/user groups. It is mostly working as intended, but specifically there's [at least] one user that has a different behavior - some user-based (not group) rules are occasionally missing, even through they did hit the policy a few moments ago. Same traffic, same packet fields - IPs/ports, etc., but suddenly it goes through Deny, instead of hitting the Permit policy. At the same time same rules works fine for a different user. After a moment, it may start hitting the proper rule again.

When checking via CLI, faulty user is registered properly- there is user-ip mapping, user-group mapping, etc. 

If creating additional rule, based on IP only, without username used - it hits that rule if it is missing the user-based rule, so there should an issue with User-ID, but not widely seen as there are a bunch of user/group rules used and they are working fine. Issue have been noticed with one specific user, but it is no different than any other user seen around.

useridd.log shows such an message, where <domain> - proper domain and <username> - username for the tricky user:

Warning:  pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1306): For <domain>\<username> user, domain <domain> does not exist in group-mapping

I've tried resetting, clearing, refreshing, etc., but that didn't help.

Don't want to overwhelm with configuration, but maybe spew some ideas where to look?

Thanks!

[rlambright]

yeah, basically the same issue as @nikoo described above.  We have about 10 users (out of 300+) that  randomly get denied internet access for 5 to 15 minutes because none of policies catch them and they get the default policy.  The useridd.log says that the user doesn't belong to any AD groups during these times.

[Abdul-Fattah]

check the User-IP mapping to see if it is againg-out correctly, if not check your User-ID Sources and change the time-out accordingly if needed. 

[nikoo]

@rlambright, at my specific case it was noted as a bug and fix was provided. General issue was with mixing UPN and SAM type of usernames in the policies. PAN-153614, fixed in 9.1.8 & 10.0.5.

"Fixed an issue where user-based policies did not correctly match if the same user was included in both a policy with the username in NetBIOS format and another policy with the username in FQDN format."

If you are running any of these versions or above - it should be a different case there.

Workaround from my case (use it at your own risk, given we don't know if it is the same issue):

"> Remove User Domain override configuration from the Group-Mapping configuration.
> Configure one specific user-attribute in all the security policies"