Hi, We have two PA-3020 in HA state, PAN-OS is 5.0.4 and we have configured 4 User-ID Agents (for now, in this troubleshoot stage, we are focused on only one agent). Problem is in IP – user mapping. Sometimes in logs we see user and in very next moment the field for username is blank. The problem is equivalent with section IP Mappings are Created but Disappear Too Soon from Troubleshooting User-ID: Group and User-to-IP Mapping. We checked the potential causes of the problem described in this article, but everything mentioned in it is working correct. We don’t see any users in DP on firewall: ----------------(active)> show user ip-user-mapping all option count Total: 0 users and on MP we have: ----------------(active)> show user ip-user-mapping-mp all option count Total: 602 users Don’t know if this means anything, but the same inputs on passive device are showing: ----------------(passive)> show user ip-user-mapping-mp all option count Total: 0 users ----------------(passive)> show user ip-user-mapping all option count Total: 28 users What is the difference within mapping on DP and MP? Could it be reason for IP mappings disappear too soon? Do you have any idea? We have a plan to make passive device active to see if anything is different, but system is big and playing with active/passive states is not option for now… Thank you very much! Best regards, Vesna.
... View more
