topic Re: Active Directory help in General Topics

Active Directory help

jbo — Wed, 14 Aug 2013 16:03:32 GMT

Hi All,

We received our first pan 3020 Monday and I have been trying to learn about the product in order to setup for production. I'm making good progress so far, but I have run into an issue importing AD users. I setup group mapping and I'm able to see groups that were imported, but no users. What am I missing?

Thanks in advance for your help.

Re: Active Directory help

jteetsel — Wed, 14 Aug 2013 16:18:57 GMT

Hello, you need need to setup a user ID agent to collect user > IP mappings. This can be done with the internal user ID Agent built in to the device or by using the external Windows User ID Agent.

Re: Active Directory help

kprakash — Wed, 14 Aug 2013 16:19:21 GMT

Have you configured ip user mapping as well. Please configure IP user mapping on the firewall, with either the agent or the agentless feature

You can view the users using the below commands:

>show user group list

This shows the groups that are learnt from the AD

>show user group name <group-name>

This command shows the users associated to that group

BR,

Karthik

Re: Active Directory help

Retired Member — Wed, 14 Aug 2013 16:21:07 GMT

so you use agentless system ? you configured user identification tab/user mapping and enabled user identification on the zone you need ?

Re: Active Directory help

jbo — Thu, 15 Aug 2013 03:08:35 GMT

Currently I'm agentless. I setup the User Mapping and added server monitors for my dc's. I have Group Mapping Settings setup. LDAP is also setup, but when I click on a policy it only shows groups and no users.

Re: Active Directory help

sraghunandan — Thu, 15 Aug 2013 03:18:17 GMT

can you verify if the user mapping shows up the user, use following command to check the same

> show user ip-user-mapping all

If the user is present can you try manually type in the username i.e first couple of letters

Re: Active Directory help

jbo — Thu, 15 Aug 2013 03:19:43 GMT

I just stumbled into my issue. Under "Server Profiles", "LDAP" I had domain.local in the domain field. So it was listing all of my users as domain.local\username. So when I was trying to find the users they didn't show up as domain\username. Amazing such a problem from one little field.

Thanks for all the help guys.

Re: Active Directory help

_slv_ — Thu, 15 Aug 2013 09:32:07 GMT

It's because you provide domain.local - change it to domain

please read this topic

Regards

Slawek

Re: Active Directory help

mbutt — Thu, 15 Aug 2013 15:21:48 GMT

Hi Jbo,

In the ldap profile under domain it is suppose to be netbios domain name and not FQDN. If you specify a wrong netbios domain name then the mapping will be incorrect and policies will not work correctly either. The reason is it appends the netbios domain name you specify when it mapping the users. Hope that helps.

Thanks

Numan