About ktm530russ

We are using the 3.1 agent still, I see the "timeout" parameter for Server Sessions, but not a configurable enable/disable. Our 4.1 agent (not in use yet, but being configured), has the Server Sessions checkbox disabled. I don't see an option on the Group Mapping Settings on the PA for this either. I don't think that this is the issue, as it just started recently, and we have not updated or made changes in about a month, but your explaination helps a lot. We just need to reverse engineer to find out why the PA is clearing the mappings... "rmonvon", thanks for the input on the timeout, we already have it set to 720 minutes to cover our 8-hour work day, and the issue has random timestamps (sometimes 10-20 minutes between losing the ID, other times 3-4 hours, etc.) It is also just a handful of our 1,000+/- clients that this affects, and those also change almost every time. Most are "fixed" by locking the workstation, then logging back on, but we had one client that lost her ID 4 times in a couple of hours. I am considering disabling NETBIOS polling, but not sure how that would affect our identification process... ... View more

There is actually NO userID being detected when the failure occurs. I pulled up the Monitor/URL Filtering, and filtered on the IP address of the computer/user having issues. There was a lot of allowed activity, and it showed the IP address and the userID. At the point of failure, when they started getting blocked, the "Source User" column is empty. We have found they can regain access by locking/unlocking their workstations, or running our old "WebSenseLogon" batch file that forced an AD update of the userID/Workstation pair. Sometimes it works for a long time, other times, it works for only a few minutes or hours. The only common factor on the ones we did troubleshooting on was the URL that showed up as the first one with no userID: http.00.s.sophosxl.net/V3/(various extensions) ... View more

Not trying to hijack the thread, but this last post (variable "<threatname/>") indicates there may be OTHER "hidden" variables that can be used... It would be really nice to know what ALL the variables are to customize each block page. (also, which variables are only allowed in certain block pages, such as Anti-Virus, versus URL filtering... ... View more