Description

In some deployments using Juniper Identity Management Service (JIMS) with an SRX Series device, usernames may not appear in session or security logs even though JIMS is installed and configured.

This can happen when the SRX is unable to populate the user authentication table with identity information.

Symptoms

The following command returns no user entries:

 
 
show services user-identification authentication-table authentication-source identity-management
 
 
warning: "There is no authentication-table entry."
 
 

As a result:

  • Usernames do not appear in session logs
  • Usernames do not appear in security logs
  • Identity-based visibility is unavailable

Solution

If interface NAT is configured on traffic from domain-connected endpoints, multiple users may appear to the SRX as the same translated interface IP address.

When this happens, the SRX cannot correctly associate individual client IP addresses with user identity information received from JIMS, so the authentication table remains empty.

Disable the interface NAT configuration for the affected domain user traffic.

Once interface NAT is removed, the SRX can correctly learn and display user-to-IP mappings from JIMS.

After the change, verify the authentication table again:

 
 
show services user-identification authentication-table authentication-source identity-management

Modification History

2024-09-05 : Article Created