How to refresh user-group mapping on the firewall

• Manual refresh can be used for troubleshooting purposes.
• The following procedure will pick up changes immediately instead of waiting for the next scheduled automatic refresh.

• Palo Alto Firewalls
• Supported PAN-OS
• LDAP Server
• User-to-Group mapping

1. Check the current state of the group mapping and the connection to LDAP servers. By default, the firewall will query the LDAP server every hour to refresh the group mappings. Use commands "show user group-mapping statistics" and "show user group-mapping state all" to confirm the details.

2. Use the command “debug user-id refresh group-mapping all” or “debug user-id refresh group-mapping “group-mapping-name” to refresh the group mapping.

 

3. The next default refresh action will take place after 3600 seconds. 

• Run the command "show user group list" to confirm the groups downloaded from the LDAP servers.

• You can run the command “show user group name "and enter the group name as per the below screenshot" to view the mappings per group.