topic Re: syntaxt issue with user enumeration in General Topics

syntaxt issue with user enumeration

Gregoux — Wed, 22 Oct 2014 13:55:49 GMT

Hello

I've an issue on the PANOS 6.0.3

about enumaration of user or group in a security policy

I have to use the complete ldap syntax to found the user in the user source column

like this

and when i tried to browse directly with the select menue

I obtain this

loading but nothing appear

anybody have this issue?

Re: syntaxt issue with user enumeration

dreputi — Wed, 22 Oct 2014 14:10:55 GMT

Hello Gregoux,

You can refer to this document:

Cannot Pull Groups from Active Directory LDAP Server

-Also you can check if the Device>User Identification>Group Mapping Settings>Select the profile>Group Include list, if it is properly pulling the group information and if you have correct groups in the include list(if any).

-You can also try by creating a new group mapping profile to see if that fixes the issue.

-You haven't mentioned if its in panorama or local device. If its panorama, make you have properly selected the master device in the device group because that's where panorama pulls group info from that selected master device.

Regards,

Dileep

Re: syntaxt issue with user enumeration

hshah — Wed, 22 Oct 2014 15:10:33 GMT

Hi Gregoux,

In the box type "cn=", it will pull all the groups. Basically you have to type something.

If you leave it blank than it takes more time to populate list. Which depends on management CPU of the box.

Same with the user name, you have to type user name in the box, It will pull the CN name. User name will never be auto populated like group names. You have to type something. Its by design.

Regards,

Hardik Shah

Re: syntaxt issue with user enumeration

dreputi — Wed, 22 Oct 2014 16:37:52 GMT

Hello Gregoux,

Please check if the user groups are being pulled in the CLI:

>show user group list

If it shows up there, it could be a GUI glitch. Try a different browser.

-Dileep

Re: syntaxt issue with user enumeration

Retired Member — Wed, 22 Oct 2014 16:41:03 GMT

try to delete Ldap, commit then add Ldap profile again.

had similar issue but not the same.

Re: syntaxt issue with user enumeration

hshah — Wed, 22 Oct 2014 17:16:25 GMT

Before that make sure you can see them in CLI with following command.

>show user group list

If it lists group than, I would suggest to restart management server once and see if that helps.

debug software restart management-server.

If that doesnt help than you might think of configuration changes.

Re: syntaxt issue with user enumeration

Gregoux — Mon, 27 Oct 2014 15:51:56 GMT

yes I did it work's

I could list all the group but the sintax is cn=bla bla bla

but it's not enough to do it work's

Re: syntaxt issue with user enumeration

Gregoux — Mon, 27 Oct 2014 15:56:25 GMT

The check box option administrator only is not involve in this case but interresting to know.

Re: syntaxt issue with user enumeration

Gregoux — Mon, 27 Oct 2014 16:05:20 GMT

I downgrade the PANOS in 6.0.2 and it works just after. think if I just resart the management plane it could be works. typicaly it looks like a delay to enumerate the user and group when i tried to add a user or group in a security policy.

the command show user group -list work's, in panOS 6.0.3 and no specific entry in the release note about this.

thank you very much for all

and sorry for delay to answer.

Re: syntaxt issue with user enumeration

hshah — Mon, 27 Oct 2014 16:11:55 GMT

Hi Gregoux,

I am glad issue is resolved finally. Release note may not have any detailed about this because it may not be a bug. And simple resource utilization issue.

Regards,

Hardik Shah