UserID mapping flags user unknown with single digit timeout secs

[rshetye]

Hi all,

I'm using Agentless UserID mapping. Since past 2 weeks, random users are dropped out of ip-user-mapping and unable to browse internet. 

When I run "show user ip-user-mapping all" on CLI:

I get 90% of connected AD users mapped to IP addresses but rest of the 10% users are logged as below -

IP           |  Vsys | From | User         | IdleTimeout(s) | MaxTimeout(s)

192.168.2.27  |  vsys1 |  AD  |   unknown  unknown   |  1   |  4

I verified that the subnet is included, clocks are synced with correct NTP, LDAP & Kerberos server works fine. Server-Monitor are "Connected" and below when run "show user server-monitor state all" -

UDP Syslog Listener Service is disabled
SSL Syslog Listener Service is disabled

Server: <server1.domain.com> (vsys: vsys1) (job 4132013)
Host: 192.168.0.31
num of log query made : 15272
num of log query failed : 144
num of log read : 478509
last record timestamp : 1742182760
last record time : 20250317033920.0-000

Server: <server2.domain.com>(vsys: vsys1) (job 4132059)
Host: 192.168.0.41
num of log query made : 28536
num of log query failed : 144
num of log read : 0
last record timestamp : 0
last record time :

I can see the successful User Logon events (event ID 4624) on the AD server for that specific IP address and device. Since they can access local resources and file server I don't think AD has any issues authenticating the users. Should I be looking for any specific flag that could cause the delay?

The VPN/GloalProtect connects these same users seamlessly but it is disrupting the business tasks on corporate network. 

Any response or tip is highly appreciated, since Level-2/3 Support Engineer is also unable to help me on this one.

[Edsnow]

If you are using agentless User id, you can change the timeout value from the user ID setting in the firewall.