topic Re: LDAP authentication profile not listing in authentication settings in Next-Generation Firewall Discussions

LDAP authentication profile not listing in authentication settings

jeromej — Fri, 26 May 2023 08:19:59 GMT

Hi,

I have a problem in adding LDAP authentication profile to the authentication settings in Device>Management. I have also tried creating a new authentication profile with LDAP in it. But getting the below error

"system -> authentication-profile 'LDAP_AUTH_WEBGUI' is not a valid reference
system -> authentication-profile is invalid"

Please advice if I have to do any changes somewhere.

Re: LDAP authentication profile not listing in authentication settings

PavelK — Fri, 26 May 2023 12:02:02 GMT

Hello @jeromej

the authentication profile under: Device > Management > Authentication Settings only supports RADIUS, TACACS+ and SAML. If you need to use LDAP to authenticate accounts accessing Firewall, you can do it from: Device > Administrators, then add account and select LDAP profile from drop down list.

Kind Regards

Pavel

Re: LDAP authentication profile not listing in authentication settings

Raido_Rattameister — Fri, 26 May 2023 14:17:28 GMT

Authentication Settings droppdown supports using authentication sequences.

You can try to put LDAP profile into auth sequence (Device > Authentication Sequense) and try if choosing auth sequence instead works (I have not tested).

Re: LDAP authentication profile not listing in authentication settings

jeromej — Fri, 26 May 2023 14:47:16 GMT

Hi @PavelK

Thanks for the response.

I tried that already but didn't work and thought that the issue could be with the authentication settings in the management window.

And I have configured the LDAP authentication and started using the LDAP account for logging in to the PA Webgui for the past couple weeks. There was some changes done by my colleague yesterday and when I tried login to the web console today, I started getting authentication error.

And I felt something must be something wrong with connection with the LDAP connectivity. So I tested the connectivity and got the connection error. There is no LDAP configuration issue and I double checked the same.

Is there anything that I am missing to check?

Thanks,

Jerome

Re: LDAP authentication profile not listing in authentication settings

jeromej — Fri, 26 May 2023 14:46:40 GMT

Hi @Raido_Rattameister

Thanks for the response.

I have configured the authentication settings the same way that you have mentioned and was using the LDAP account for logging in to the PA Webgui for the past couple weeks. But there was some changes done by my colleague yesterday and when I tried login to the web console today, I started getting authentication error.

And I felt something must be wrong with connection with the LDAP connectivity. So I tested the connectivity and got the connection error. There is no LDAP configuration issue and I double checked the same.

Is there anything that I am missing to check?

Thanks,

Jerome

Re: LDAP authentication profile not listing in authentication settings

Raido_Rattameister — Fri, 26 May 2023 14:51:02 GMT

Monitor > System

Filter "( subtype eq auth )"

Any events about LDAP server there? Like auth-server-down for example.

Re: LDAP authentication profile not listing in authentication settings

PavelK — Fri, 26 May 2023 21:41:18 GMT

Hello @jeromej

thank you for reply.

To drill down root cause for failure, could you please follow this KB: How to Troubleshoot LDAP Authentication? Also, make sure that Bind-dn username and password are up to date.

Kind Regards

Pavel

Re: LDAP authentication profile not listing in authentication settings

jeromej — Sat, 27 May 2023 07:19:20 GMT

Hi @Raido_Rattameister

The logs shows the "auth-server-down". But when checking the connectivity between the firewall and the server is good as they both communicate with each other. Please find below the error log.

Type	Threat/Content Type	Config Version	Generate Time	Virtual System	Event ID	Object	fmt	id	module	Severity	Description
SYSTEM	auth	2816	5/27/2023 11:45		auth-server-down		0	0	general	critical	LDAP auth server is down !!!

Re: LDAP authentication profile not listing in authentication settings

jeromej — Sat, 27 May 2023 07:52:31 GMT

Hi @PavelK

I have tried the steps given in the KB and got the below result.

1.1 #show shared server-profile lda - Invalid syntax

1.2 The Base DN not listing automatically. It wasn't listed when I had it configured previously but the LDAP authentication worked until couple days back.

1.4 Couldn't browse the LDAP tree browser when configuring Group-Mapping.

The Bind-DN Username and password are up to date. Yet I am getting this connectivity issue.

Please advice.

Re: LDAP authentication profile not listing in authentication settings

PavelK — Sat, 27 May 2023 12:10:06 GMT

Hello @jeromej

could you please check logs from CLI: tail follow yes mp-log authd.log? This should give definitive answer what the issue is.

Kind Regards

Pavel

Re: LDAP authentication profile not listing in authentication settings

jeromej — Mon, 29 May 2023 11:17:25 GMT

Hi @PavelK

When checking the logs, I get the above error. It seems that there is some issue with the connectivity.

Is there a way to check if the ldap server receives the request on the port 389 from Palo alto? Since PA has removed telnet from PANOS 5.0, I couldn't find a way to know that.

Thanks,

Jerome

Re: LDAP authentication profile not listing in authentication settings

Raido_Rattameister — Mon, 29 May 2023 11:49:18 GMT

Is Palo mgmt interface and ldap server in same subnet or does traffic from Palo mgmt interface traverse Palo dataplane so you could see logs?

To test tcp 3way handshake you can use command "ssh port 389 host <ldap server ip>"

Re: LDAP authentication profile not listing in authentication settings

jeromej — Mon, 29 May 2023 12:34:58 GMT

Yes @Raido_Rattameister , PA mgmt interface and ldap server are in the same subnet.

When test the handshake, I get the below result.

Thanks,

Jerome

Re: LDAP authentication profile not listing in authentication settings

Raido_Rattameister — Mon, 29 May 2023 14:54:10 GMT

Connection reset by peer is expected because with ssh command you try to initiate ssh not ldap.

As mgmt and ldap are in same subnet then next step is to take packet capture on mgmt interface.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CleECAS

Re: LDAP authentication profile not listing in authentication settings

jeromej — Tue, 30 May 2023 06:11:45 GMT

Hi @Raido_Rattameister ,

There is no packet sent/received when checking with tcpdump.

Re: LDAP authentication profile not listing in authentication settings

jeromej — Tue, 30 May 2023 11:28:57 GMT

Man I had found what I did wrong... I had not given the LDAP service route source in the Service route configuration. After giving that our box had connected with the LDAP server and everything works fine now. But earlier it was the same when the LDAP works without any such configuration. I wonder how it worked.

Anyways, thanks for the support and assistance.