Master User-id device receives non-functioning configuration for userID Group Include list from Panorama

ClaytonHuml — Tue, 26 Apr 2022 22:10:50 GMT

I have a User-Id configuration that has been working successfully for 6 months. I went to add a new group to the group include list, and the syntax that was written from Panorama had JUST the group name in this form :domain\group_name. The working groups as listed by running the 'show config merged | match group-include-list' all have a syntax similar to this: [cn=group_name, ou=users and groups, ou=yyy, dc=my_domain, dc=com] etc etc . the FW does not recognize the new group, and cannot retrieve any of the users, so it is non-functional. the previously working groups still work.

FYI: the groups show up correctly when I browse the dialog in Panorama - but none of them, even the working ones, display the cn-ou-dc parameters.

Panorama 9.1.12-h3

Pa-VM100 9.1.0-h3

Re: Master User-id device receives non-functioning configuration for userID Group Include list from Panorama

PavelK — Tue, 26 Apr 2022 22:32:16 GMT

Thank you for the post @ClaytonHuml

if you want to add a new AD group into include list from Panorama, you have to configure AD group with whole LDAP string. Here is corresponding KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIOCA0

After this is pushed to managed Firewall, you will see AD group in this format: domain\group_name on Firewall side.

Kind Regards

Pavel

topic Master User-id device receives non-functioning configuration for userID Group Include list from Panorama in Panorama Discussions

Master User-id device receives non-functioning configuration for userID Group Include list from Panorama

Re: Master User-id device receives non-functioning configuration for userID Group Include list from Panorama