- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
Active Users refreshed every few seconds, incorrect policies applied
03/26/2020 
48 People found this article helpful
47,274 Views
Description
This article shows the SSO Agent configuration to apply when your Active Users monitor shows a Session Time for all users of 0 or 1 minutes. This may happen when SSO is incorrectly configured and it will poll/refresh all users every few seconds causing a very high CPU usage as well as incorrect policies applied.
Cause
It looks like these users are just being replaced by the same user and this is caused by incorrectly configured Polling and/or Scanning options.
- The Agent seems to be scanning and notifying the firewall of a change.
- The firewall logs messages are relating to polling and detected logouts.
- The user is being logged back in by generating traffic and causing SonicOS to request identification.
- Polling successfully finds user and the Agent reports logoff/new login despite user being the same
- Old user is being logged out while the same user is being logged in via NetAPI
- Polling starts again and the cycle goes on.
Resolution
Applying the following changes, you should mitigate or solve the issue:
- SSO Agent (Directory Services Connector) changes:
Go to the SSO Agent (SonicWall Directory Connector Configuration Tool), right-click on SonicWall SSO Agent and then Properties:
Disable SCAN Users from the SSO Agent configuration
Enable Preserve Users option to keep the user cache when the SSO Agent service restarts from the SSO Agent config
Disable the authentication methods not used by the SSO Agent --> I.E. If all the users are getting recognized using NetAPI but on the SSO Agent it's enabled NetAPI+WMI, disable WMI.
NOTE: Make sure the SSO Agent is updated to the latest version
- On the Firewall:
- Go to Users | Settings and click on Configure SSO
- Go to the Users tab and enable the option "Poll using the same Agent that identified the user"
If the issue persists, please collect all the data to troubleshoot the issue:
- Firewall logs (TSR, EXP, Logs) | How to Download Tech Support Files (TSR, EXP, Logs)
- Packet capture (port 2258) in both LIBPCAP and HTML formats
- SSO Agent Logs
- Screenshots of the issue
Related Articles
- How to force an update of the Security Services Signatures from the Firewall GUI
- How to upload security services signatures manually on Closed Environments?
- How to Create Gen 7 Settings File by Using the Online Migration Tool
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive E10000 Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
YES
NO