About apackard

Note: Should add that the IP range is not being filtered, and we have other valid maps on the same subnet. ... View more

Bit of a 'how long is a piece of string question' I'm afraid, so many factors! However - hopefully a bit more useful - one issue I found that could result in mapped users being 'lost' was enabling the 'Server Session' tracking in the agent.  Not sure why specifically, but if this check returns a user mapping that does *not* tally with the currently mapped users the agent 'resets' the node so it doesn't have either account associated. The next time some device activity raises an AD event entry the user account is rermapped, but this does cause periods where no user is known for the device, which sounds like it could be what you're seeing? Try playing with the timeouts, settings etc; or enable transparent NTLM auth for that source IP so it will perform an interactive authentication as that way it will force a background authentication when the kiosk machine connects to the web and should block it. ... View more

Not with Titus, but with a similar protective marking product..... ... View more

Thanks for the reply. PAN-OS is 4.1.2 and UserID is 4.1.4-3. The doc was 'User Identification Operations 4.0, and it says:- "Open Server Sessions Any connections to a file or print service on the Domain Controller will also be read by the agent. If the user / IP combination for the session does not match the combination that the Agent last learned the mapping will be removed and the user at the IP address will become unknown. The agent will not update user data as a result of information learned from the open server sessions. If the open session confirms the user at the IP address then that mapping will have its lifetime renewed." I could not see another user mapping to the IP when this occurs for me and, as a test I disabled Server Session tracking, and the problem (appears) to have gone away! Rgds ... View more

Hi - have you got any further on this? I have a similar issue - a subset of users (inc. me at the moment!) seem to be much less reliable than the vast majority.  I can actually see my mapping being created, then removed, within 10 seconds, as if something is over-writing the record. The one thing I'm looking at the moment is the 'server enumeration' function in the Agent - as the documentation says that this will remove a current map if it does not match what the enumeration returns. Rgds ... View more

I'm guessing he's asking for something that I was interested in. I have Kerberos based authentication working, so if I setup a user called BOB, and I have an AD account with the same name I can authenticate using the BOB AD password - all good. However, what I want is to be able to link an AD group without having to create the local account - so if I add TOM to the AD group it automatically allows TOM to login to the Palo without having to create the local account to map to... My view anyway! ... View more

Thanks for the reply. Yes, change committed on the Palo, user cache cleared via the CLI and Palo agents restarted for good measure. None of the above stop IP addresses that are either explicitly excluded, nor implicity excluded, from being registered with the PA. ... View more