About jasbeck

Interesting - I opened up a support case about this very issue but appearntly they're still researching the problem or think it's being caused by a security rule that PAN is applying. Currently being experienced when users attempt to go to www.foxnews.com or www.bing.com. Entering in the URL's without the "www." works just fine and presents a CP page for people to authenticate against (using standard block page). Traffic that is from unidentified users is supposed to be CP'ed - the block page with the underscores instead gives the computers IP as the user id and does not prompt for CP. Running 4.1.3. ... View more

I've opened a ticket but it's been in "reasearch" since 19 March. Hence my open post to here to see what other ideas folks may have. ... View more

Hi Stefan, I thought permissions and network ACLs as well at first, but here's the crux: the user id agent fails the WMI poll, but I can manually run a WMI poll from command line and it polls correctly (using same computer, same account as user id service, etc...). So it's not a permissions nor a networking issue. It's intermittent as well to add to the problem. We have not installed the new agent as we are leveraging Kerberos instead of LDAP for user to group mappings. We have plans to move to the newer agent and use LDAP instead of Kerberos, but not at this time. ... View more

Hi Jason, I think the statement of ".... those new unknown ips will be dropped" is incorrect. I've restarted the user id agent service and the number being reported ramps up from 1001 to (currently) over 5000. I think the ones it can't get to are just re-added to the queue. I typed in the CLI command to see unknown users on the firewall and it came back with zero. Questions: How does this list of unknown user to ips work with the known users to ips that are polled every wmi probe time (60 min for us)? Is it the same queue? Will shortening or lengthing the wmi probing window make it better or worse? I know that unknown user to ip traffic is sent from the PAN to the user id agent for immediate polling to id them. Is this added to the known user to ips that are normally polled at WMI time intervals (documentation indicates as such)? If that is the case, then each user id agent can handle no more than 1000 individual IPs - otherwise it would automatically be over 1000 each poll period. The example cited in the document (User-ID Best Practices PAN-OS 4.1) of 6000 computers being polled at 10 minute intervals would automatically exceed the max queue length since ALL of the 6000 ips would be queued at once to poll every 10 minutes. Or is there some sort of interval within those 10 minutes to split the ips up? Or are unknown users for ips placed in a different queue? Thanks! ... View more