Update on the original situation: There's a serious flaw in using the PAN agent: - domain user logs on, ip is mapped to user - domain user logs off - local user logs on before the domain user-to-ip mapping times out on the device (3600s) - as long as no other domain user logs on to the same pc, the PAN agent sees the ip active, but doesn't even check if it's still the same user Proof of this is in the PAN agent log, fragment of the log at the time a local user was logged on (local username is completely different from domain username): 2011 02 15 13:14:04, PAN_AGENT_GET_NEW_IP: Number of IPs received from device (127.0.0.1): 1 2011 02 15 13:14:04, QueryIP 10.39.1.98 (mengrp\dieter) done 2011 02 15 13:14:04, Sending 1 IP(s) to device (127.0.0.1) 2011 02 15 13:14:04, [1] 10.39.1.98 : mengrp\dieter to device (127.0.0.1) This gets logged every other minute or so. Doesn't even matter if the local user logs of or not. The mapping never times out. You'd expect it to time out, what else is the age-out timeout setting in the PAN agent for ? How can I ever be 100% certain that logged traffic is from a specific user ?
... View more
