topic Re: Test command does not work in General Topics

Test command does not work

Matlu_NN — Tue, 11 Jul 2023 16:00:48 GMT

Hello, team.

I have a problem.
I have a couple of users created for read mode administration of the Palo Alto Firewall Cluster (they are local users).

When I try to test the Test Authentication Server Connectivity (I follow the documentation to the letter), I am constantly getting the same error when testing with the local users.

Any idea how to solve this, please?

I just want to "prove" to the end users, that the credentials "do work" without problems.

Thanks for the feedback.

Re: Test command does not work

JayGolf — Wed, 12 Jul 2023 03:57:55 GMT

Hi @Matlu_NN ,

Are these users created in the Local User Database or users created via External Authentication like Radius, SAML, LDAP, etc..

Re: Test command does not work

Matlu_NN — Fri, 14 Jul 2023 17:06:20 GMT

Hello,

They are local users.

Is there any way to successfully perform the test command to validate if the credentials are working or not?

Greetings.

Re: Test command does not work

TomYoung — Mon, 17 Jul 2023 01:54:31 GMT

Hi @Matlu_NN ,

I don't see you setting the target vsys. Have you followed these steps? https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-cli-quick-start/use-the-cli/test-the-configuration/test-the-authentication-configuration

Thanks,

Tom

Re: Test command does not work

Matlu_NN — Tue, 18 Jul 2023 15:05:48 GMT

Hello,

You need to configure the "<vsys-name>"????

I have a Firewalls Cluster, and I do not see anything in the configuration of the equipment that makes me "recognize" if I have configured or not the "vsys".

Is this something that comes active by default or is it something that must be activated????

Working with vsys, can impact on the configuration that has the Cluster of equipment?

Greetings.

Re: Test command does not work

TomYoung — Tue, 18 Jul 2023 17:48:23 GMT

Hi @Matlu_NN ,

The CLI command is not configuring anything on the NGFW, but rather setting the context for your CLI test command. As the doc says in step 1, "Specify which virtual system contains the authentication profile you want to test. This is only necessary if you are testing an authentication profile that is specific to a single virtual system (that is, you do not need to do this if the authentication profile is shared)."

This command only applies to the current CLI session.

Thanks,

Tom

Re: Test command does not work

Matlu_NN — Tue, 18 Jul 2023 20:18:19 GMT

Hello,

Actually, I don't know what is the correct syntax of the command.
I am applying what I can understand from the shared document, but I always get the same result.

Can you tell me what you think is the error I am having in applying the command?

Note:
It is important to mention, that this is a local account created on the Palo Alto Firewall itself.

Thanks

Re: Test command does not work

TomYoung — Tue, 18 Jul 2023 20:18:11 GMT

set system setting target-vsys vsys1

Re: Test command does not work

Matlu_NN — Tue, 18 Jul 2023 20:21:56 GMT

Hello, friend.

And in the command:

test authentication authentication-profile <authentication-profile-name> username <username> password.

What should I put in the <authentication-profile>?

My local users have not created an "Authentication-Profile".

Is it optional?

Re: Test command does not work

TomYoung — Tue, 18 Jul 2023 20:35:28 GMT

Hi @Matlu_NN ,

Great question! Since you have no local authentication profile, I assume the "local users" are under Device > Administrators and not Device > Local User Database > Users.

You cannot use the "test" command to test for local administrators. You would test by logging into the GUI or CLI with each username.

Thanks,

Tom

Re: Test command does not work

Matlu_NN — Tue, 18 Jul 2023 20:42:26 GMT

Hello,

Then the command "test", would only be useful to test the "local users", that are inside the option "LOCAL USER DATABASE" ????

Greetings.

Re: Test command does not work

TomYoung — Tue, 18 Jul 2023 20:47:06 GMT

Hi @Matlu_NN ,

That is correct. When you create an administrator you can configure an authentication profile for that administrator. Your admins could authenticate with their AD credentials (LDAP) if you want. In order to use the local user database, you would create an authentication profile with a Type: Local Database. Then you could use the test command.

Thanks,

Tom

Re: Test command does not work

Matlu_NN — Tue, 18 Jul 2023 21:13:48 GMT

Hello, my friend.

Can I create a test user in "Local User Database" -> "Users" and apply the command?

For example, create an account like the following:

Username: jchampion
Password: 1234abc#

I can run the "Test" command without having a security policy, can't I?

The command would be something like this:

test authentication authentication-profile Local Database username jchamion password 1234abc#

This is the flow it should follow, and the command should be successful, right?
Or is there any observation on your part?

Thanks for your help.

Re: Test command does not work

TomYoung — Tue, 18 Jul 2023 21:16:20 GMT

Hi @Matlu_NN ,

You can create a test user as you described and test. You would need to create an authentication profile with a Type: Local Database, and test against that authentication profile.

Thanks,

Tom

Re: Test command does not work

Matlu_NN — Tue, 18 Jul 2023 21:20:46 GMT

It is not necessary to have a firewall rule to test this, right?

And the VSYS, would be the VSYS1, according to the scenario I could show you, right?

Re: Test command does not work

TomYoung — Tue, 18 Jul 2023 22:47:50 GMT

Right, and right.

Re: Test command does not work

n.willemkotze — Wed, 12 Mar 2025 10:58:26 GMT

What is the solution here?