User IP-user-mapping incorrect

[rrau]

(PA3000 series FW running 6.0.2) Getting users being blocked by the captive portal from a local service account running on their machine.. only way around it is to disable the service and/or account and then flush the user to ip mapping cache.  Any way to eliminate this????  It has been added to the "ignore list" text file on the server running pan agents, however, its a local account so its not working.

[pulukas]

I believe the exclude list for the subnet will do what you want here and ignore this user account.

How the User-ID Agent Include/Exclude List Works

[rrau]

I don't want to exclude an entire subnet..  its happening on all subnets with 1 particular local account.

[_slv_]

Is this account is used  more than one computer? why it's local?

Do You use AD integration or not? in wchich model: agent or agentless?

With regards

Slawek

[pulukas]

Sorry I misunderstood.

This is the document for adding user accounts to the ignore list.

How to Add/Delete Users from Ignore User List using Agentless User-ID

[rrau]

This account is on every computer.. it automatically gets created and is running a particular Citrix service after installing Citrix Receiver (for our Citrix environment)

[rrau]

Yes, we use AD but its a local acct.  agentless

[Wenar]

What do you mean with "blocked by captive portal"? The captive portal should only be shown if the user is unknown. If there is already a user mapping the captive portal rule should not match. Even local accounts should be possible to ignore. Is there a user mapping for the ip if the client is blocked?

[rrau]

Web Page Blocked

User: ComputerName\__vmware_user__

URL: www.google.com/

Category: block-list

In accordance with company policies, this website has been blocked.

If access to this site is required for Business Usage, then please submit a support request.

**it is being blocked by a local account that does not have or should not have Internet access**

[hyadavalli]

Hello,

Are you getting user-ip-mapping from user-id agent or from captive portal authentication?

Regards,

Hari Yadavalli

[rrau]

user-id-agent

[cpainchaud]

did you disable WMI/Netbios scanning ? local accounts can only be seen by these means.

[rrau]

WMI probing  = Yes

NetBIOS Probing = No

WMI/NetBIOS Probing Interval = 20

[cpainchaud]

turn WMI probing off then.

[rrau]

didnt help