topic Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is possible in General Topics

Not able to configure user/user groups under Global Protect Gateway under Panorama, same is possible

KPITNOC — Mon, 23 Jul 2018 08:53:32 GMT

We have configured Global Protect VPN. We are trying to configure specific user/user groups under Global Protect Gateway in AGENT config on Panorama server. Unfortunately, we are not able to see any user ids/user groups under drop down list. But we can see list locally on firewall.

Need your help.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

Mick_Ball — Mon, 23 Jul 2018 13:11:28 GMT

is the user list visible on the actual firewall itself..

does the userlist auto populate when you start typng on Panorama

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

KPITNOC — Mon, 23 Jul 2018 13:21:11 GMT

1. Yes, user IDs/Groups are visible on gateway but not on panaroma.

2. yes, userlist auto populate when you start typng on Panorama.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

Mick_Ball — Mon, 23 Jul 2018 13:27:57 GMT

yes i think this is a little confusing.

the user list doust display on the local firewall but only if those users have been included or used.

try creating a new \agent\config on the firewall and see what happens when you try to add users. it only shows the groups, not members. Panorama acts in the same way.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

BrandonWright — Mon, 23 Jul 2018 13:42:54 GMT

Hello KPITNOC,

This is one thing that I've always found a little bit hoakey on Palo Alto when using Panorama to manage things. The user-id and group mapping process happens on the local firewall, but on Panorama, its not necessarily the same. If you're configuring a User-Group mapping on the local firewall, Panorama in the past would not see this. I always had to copy the groupname that shows up on the local firewall and push that setting through Panorama, or use the LDAP long name notation to push this from Panorama. It looks like this may have changed:

https://live.paloaltonetworks.com/t5/Management-Articles/Active-Directory-Groups-in-Panorama-Rules/ta-p/57020

In the above article it says they fixed this, and the group mappings should be pulled from the master device. Do you have a master device setup for that device-group? If not, try setting the device that has the group mappings on it and then see if it populates.

Let me know what you find there.

Thanks

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

BrandonWright — Mon, 23 Jul 2018 13:44:46 GMT

I forgot to mention, you will probably need to commit the Panorama configuration after setting a master device before anything will populate.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

KPITNOC — Mon, 23 Jul 2018 13:48:34 GMT

Hi, Thanks for your mail.

We have configured Master device on Panorama. Also, we are able to configure/select user ids/groups while configuring security policies on same Panorama server.

We are not able to see users list/groups under Global Protect Gateway in AGENT tab. Same is visible locally on firewall.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

LukeBullimore — Wed, 25 Jul 2018 14:51:27 GMT

Hi @KPITNOC

What version is your Panorama on? The User-ID process running on Panorama was only implemented in PAN-OS 8.0 and above.

Thanks,

Luke.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

KPITNOC — Wed, 25 Jul 2018 15:17:50 GMT

Hi,

Thanks for your reply.

It is currently expected design of Panorama to not show user-group/user ids information in Templates even when we have configured Master device under device group.

We are raising Feature Request with Palo Alto team for the same. We will share number asap. Please give your vote for it.

Thanks again!

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

DLONGPRÉ — Thu, 13 Feb 2020 17:33:12 GMT

Is it fixed because I think we have the same issue (Panorama - PAN-OS 9.0.4) ?!

Thanks,

Dominic.

Re: Not able to configure user/user groups under Global Protect Gateway und

KIMvdLinden — Fri, 05 Jun 2020 10:39:53 GMT

We're facing this issue as well.

Feature requests take for everrrrrrrr

I'm now going to test if using the long string is a work-around...

Anybody else found a work-around for this other than making a local override on the FW?

kr,

Kim

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

Dereje — Wed, 20 Oct 2021 01:46:59 GMT

Does this issue got fixed, I am having similar problem not be able to see the source user/group list in the GlobalProtect Agent configuration?

Thank you

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is poss

NickAssar — Thu, 05 Jan 2023 02:51:49 GMT

Nearly 4 years later and this issue still isn't fixed... at least not in 9.1.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is possible

Raido_Rattameister — Thu, 05 Jan 2023 03:08:45 GMT

Droppdown will not populate users/groups indeed but you can enter them manually and they will take effect.

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is possible

NickAssar — Thu, 05 Jan 2023 21:55:51 GMT

What format does this take? Is it the fully qualified distinguished name (like adding it to group mappings) or just the domain\name (like adding it to security policies)?

Maybe include this in future Globalprotect documentation given they don't seem to be fixing this anytime soon in Panorama...

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is possible

Raido_Rattameister — Thu, 05 Jan 2023 22:28:01 GMT

Check under "Monitor > GlobalProtect" in what format gateway sees username.

You can use all 3 for testing:

domain\first.last

first.last

first.last@example.com

For group you can also test full LDAP path that you can get from domain controller command prompt with command like:

dsquery group -name "VPN Users"

Re: Not able to configure user/user groups under Global Protect Gateway under Panorama, same is possible

MichealSwart — Wed, 03 May 2023 11:28:55 GMT

Same issue and here is the response from Tech Support. We went over the configuration, and everything appears to be in order. We talked about how Panorama doesn't automatically populate user-group information for any references in the Template.

As I explained, that it worked in security policy doesn't mean it should automatically work in Global Protect as, according to the backend engineers, the device group and the templates are two different functional variables (from the backend coding).

As a result, we're unable to auto-populate user group mapping from CIE in Panorama GUI for Portal Agent config selection criteria under Global Protect portal settings, or for gateway client-settings under Global Protect Gateway settings.

This is expected behavior, and we'll need to manually input the user group when the configuration is pushed from Panorama. We also noted that there's a feature request for this capability, identified by ID 8467 (FR-8467).

Please don't hesitate to contact your account team to vote for the feature request on your behalf.
Nott going to be fixed soon. Will need to add manually until FR is accepted.