Hello, From what I've found searching on that error, it looks like this happens if there are too many unknown IPs that are sent to the pan-agent from the Palo Alto Device. "Pan-agent can only keep 1000 unknown IPs in the queue. For each unknown IP, pan-agent needs to use NetBios/WMI to query the IP if NetBios/WMI is configured. So, since the max amount of unknown ips that the pan agent will keep is 1000, if the incoming unknown IP exceeds that rate, those new unknown IPs will be dropped and you will see this log. " Ideally, you would rather fix the unknowns by creating exclude lists on the agent where it's not trying to map every single IP or network if possible. If this isn't possible, we still need to try and fix the root of the issue which is all the unknowns. Run a > show user ip-user-mapping type UNKNOWN This should show you all of the unknown users on the Firewall. Note, it may be different than the agent. If you're unable to figure out why the users are unknown and not getting mapped, you can respond here, but you may need to get a case opened with us to investigate. Thanks, Jason Seals
... View more