About JonHill

Currently the Cache Timeout is set at 15 mins, I've read a couple of articles that this should be a lot higher and ideally half the DHCP refresh. I've also seen other articles that say if you're not using client probing it should be set at 600. Server log monitor is set at 2s and session read frequency is set at 10s. Any recommendations as to what these timers should be set at would be great? Thanks Jon ... View more

Apologies for not replying sooner its been manic here and this is the first chance I’ve got to reply to your questions.   Thanks   Jon   What version of PanOS?                       9.08 Are you using samaccountname and userprincipalname?  Just samaccountname   Do you have the user-id agent parsing every single sec-event-log on every DC?               Yes Do you have "enable user-id" on for every internal zone?     No, just our two Trust zones, WAN and Internet. Do you use Terminal Services? If so do you have that agent in that environment as well? We don’t use Terminal Services in our environment but do use VDI. Are you using the same SPG for all rules or do you have multiple SPG's? Depending on your environment you can have one source subnet hitting a different policy /w a different SPG and URL filter if configured.    I have seen issues where a person is using a cached authentication in Windows when not connected to work via VPN and then attempts access which fails with the same type of error.     For testing I would use sites that are not super-trackers to see if the issue is as simple as all internal zones having user-id enabled. I would also check to see when it fails from the command line what it shows.    > show user ip-user-mapping all | match ken jhill@PHMDP01_PAN5250(active)> show user ip-user-mapping all | match jhill 10.170.38.229                                 vsys1               UIA     ulh\jhill                        867            867 10.130.239.12                                 vsys1               UIA     ulh\jhill                        868            868    Can the firewall get the updated ldap group membership?  Yes it can. > show user group list cn=blah.blah.f00   > show user group name cn=blah.blah.f00  It pulls back all the users in a group >show user group-mapping state Servers    : configured 4 servers               ... View more

As you say it was down to the speed at which I re-enabled the interfaces that it had permanently stayed with the peer.   Is there anyway of changing these timers and where do I find them?   Thanks  ... View more