UserID periodic empty groups issue

[Frank-Bussink]

Hello,

after opening a ticket with the support and finally after 4 debug sessions over a month time. I wanted to share our issue we encountered, and maybe it could help somebody with the same issue.

Symptom : Every hour, we had our UserID based policy not working any more for around 3-4min every hour and on Commit from Panorama. Very odd.

After time, we discovered that during the bug, the Groups were empty (not any users any more)
show user group name "cn=xxx,ou=security group,dc=xxx,dc=local"
Group-Mapping was linked to LDAP profile to the Windows Domain Controller.

The issue was that we had two groups under "User Identification / Group Mappings Settings"
One had only one specific Included Groups
And the second one, had was created with "Search Filter" and was returning 4 groups.

And the issue lied that both had the same group.
One would think it's not an issue, but it was. I'm still trying to push the support to report it to Engineering, but I least I've documented here.

My resolution, was to delete the 1st as it was included in the second, and no more issues 😕

[kiwi]

Hi @Frank-Bussink ,

Thanks for sharing your experience !

Kind regards,

-Kim.