topic Re: Global Protect with Active Directory Accounts in General Topics

Global Protect with Active Directory Accounts

jnunham — Wed, 12 Jun 2013 13:50:09 GMT

Hello all,

I have what might be a simple question. I want to authenticate to Global Protect SSL-VPN using my current Active Directory users. Do I need to have the User ID software installed on a domain server to do this? If thats needed for LDAP can one of the other server types do what I'm looking for with out the software on a server?

I have a PA-500 running 5.0. I have set-up the LDAP "server" and I have the authentication set-up but its still not working.

Also, how can I test if the LDAP connection is working right or not? Is there a test option someplace or something I should look for in the logs? Is there someplace that should display users or groups?

Thanks,

Doug

Re: Global Protect with Active Directory Accounts

Retired Member — Wed, 12 Jun 2013 13:56:58 GMT

Hi,

You can use user-id function agentless system.

Also look at group mapping if you can see all groups or not.if ldap is ok you should see groups.

How did you configure auht. profile ldap ?

Re: Global Protect with Active Directory Accounts

VinceM — Wed, 12 Jun 2013 14:07:40 GMT

Hi,

Here a doc which can help you: https://live.paloaltonetworks.com/docs/DOC-4332

Just keep in ming that maybe for external access your AD password are not enough strong 🙂

Setup a radius or new account for vpn can take time but for vpn auth it can be needed.

Re: Global Protect with Active Directory Accounts

jnunham — Wed, 12 Jun 2013 14:36:21 GMT

HI Panos,

I was able to go into group mapping and was able to get into AD and select a user group, so it does look like it can read AD. I went back to the auth profile remove "all" and added the now available AD query. But still no luck. I think I'm going to re-review everything since I've been working at it for awhile I could have the wrong profile or server selected some place.

Vince - is there a password strength check someplace between AD and the Global protect portal? The one I'm testing with right now should be ok, but I know I have users that have not very strong passwords. I guess I was counting on the system just passing the passwords through reguardless of how strong they might be.

Thanks,

Doug

Re: Global Protect with Active Directory Accounts

VinceM — Wed, 12 Jun 2013 14:45:24 GMT

For password strengh, you can configure a minimum password complexity politic in the palo but only local account ... sorry. Else this politic have to be taken in charge by the remote authent server (AD in your case).

Re: Global Protect with Active Directory Accounts

jnunham — Wed, 12 Jun 2013 14:52:02 GMT

Ok this is working, I found the missing piece in the re-review.

I had to include my new AD members group from User Identification in the Global Protect portal set-up and now its all working!! Now I can jump into deeper testing.

Thanks all.