topic Re: Palo Alto cant filter users in a group in General Topics

Palo Alto cant filter users in a group

soporteseguridad — Mon, 22 Jul 2013 14:13:40 GMT

Hi,

I have a PA2050 v(4.0.11) and PAN-Agent for ldap users and groups. I have created a a group in my Active directotory and i configure a policy for this group but i try to check this policy with one user in this group and firewall dont let me passtrough.

I cant see that my user belongs to this new group but i can add this group in policies.

telindus@fw1orgt(active)> show user ip-user-mapping ip 10.1.12.70

IP address: 10.1.12.70

User: oartg\brepr

Ident. By: AD

Idle Timeout: 1956s

Max. TTL: 1956s

Groups that user belong to (used in policy)

Group(s): oargt\internet

oargt\satd

oargt\diba

My user brepr belongs to group oargt/accessfor in the AD but i cant see it in this output. I can apply the group oargt/accessfor in policies.

Thanks

Re: Palo Alto cant filter users in a group

Retired Member — Mon, 22 Jul 2013 14:35:09 GMT

if you have a security rule for accessfor

you should also see that

try to refresh the mappings

debug user-id refresh group-mapping

Re: Palo Alto cant filter users in a group

soporteseguridad — Mon, 22 Jul 2013 15:38:21 GMT

i dont have that command debug user-id in my PA version 4.0.11..... how can i refresh the cache for groups or something like that?+

My user brepr belongs to satd and the group satd belong to accessfor. is this important???? can i map a group within another one?

Re: Palo Alto cant filter users in a group

Retired Member — Mon, 22 Jul 2013 20:24:18 GMT

Hi,

I missed that you use 4.0.x

with 4.0.x your agent will do both group and user mapping

for nested groups I made test with 5.0.x and it was working but did not do with 4.0.x so I am not sure

on agent do you see all groups ?

Re: Palo Alto cant filter users in a group

Retired Member — Mon, 22 Jul 2013 20:27:58 GMT

for the command

try

debug device-server refresh user-group all

Re: Palo Alto cant filter users in a group

soporteseguridad — Wed, 24 Jul 2013 07:45:56 GMT

I cleared the cache groups and device-server and it didnt work

Its very weird because i can add this group accessfor in a policy but i cant see any users in this group.

I have created the policy again.

I have restarted the pan agent service

I have cleared all caches users/groups

What more can i try??

Re: Palo Alto cant filter users in a group

Retired Member — Wed, 24 Jul 2013 07:54:08 GMT

try to create another new group at the same place and make a user member of it.Than refresh groups again.After look if anything changes for that user for new group ?

Re: Palo Alto cant filter users in a group

soporteseguridad — Wed, 24 Jul 2013 08:08:23 GMT

Its solved

i put these commands and now its working

debug dataplane reset user-cache all

debug device-server reset pan-agent all

THANKS A LOT

Re: Palo Alto cant filter users in a group

soporteseguridad — Wed, 24 Jul 2013 08:11:33 GMT

i think the command whick solved was debug device-server reset pan-agent all

thanks a lot