topic Re: How to permit GP access with two different domains? in GlobalProtect Discussions

How to permit GP access with two different domains?

Amaro123 — Thu, 04 Nov 2021 20:13:52 GMT

Hello all,

I'm setting up a second authentication domain in GP but I'm not successful trying to authenticate.

The domain DC=domain1,DC=br,DC=local works normally.

The new domain DC=domain999,DC=local does not work. When I try to authenticate through it I see in the logs that it failed but it recognized the domain and the IP of the AD.

This new domain I configured in: Device>Server Profiles>LDAP.

Then on: Device>Server Profiles>User Identification>Group Mapping Settings

Then on:Network>GP>Portals>"vpn_portal">Agent>^vpn_agent">User/User Group

Then on:Network>GP>Gateways>"vpn_gtw">Agent>Client Settings

When I insert domain999.local/user.name, my authentication failure and generate these logs:

Re: How to permit GP access with two different domains?

BPry — Sun, 07 Nov 2021 15:06:35 GMT

@Amaro123,

Did you update your authentication profile to actually include the new LDAP server profile? It doesn't look like you did, so that new LDAP server profile isn't actually being used. The initial auth-fail message you have in your picture is what you need to correct before going any further.

Re: How to permit GP access with two different domains?

Amaro123 — Mon, 08 Nov 2021 21:03:54 GMT

Hi BPry,

My Authentication Profile before this configuration had local
authentication and an LDAP. Now, in addition to this same configuration, it
also has the new LDAP.

In the image I showed he is trying to authenticate to the new LDAP.

When I test this same user via CLI, my authentication is successful.

Re: How to permit GP access with two different domains?

Mick_Ball — Tue, 09 Nov 2021 18:37:40 GMT

Are you using the username modifier in the auth profile... i only ask as I’m sure this is ignored when using cli.

i would use Monitor/Packet Capture with the ldap server in a filter to see what the palo is sending. It may be adding additional information to the request...