topic Re: Failed to execute op command in General Topics

Failed to execute op command

Westcon2 — Sun, 04 May 2014 13:08:23 GMT

We frequently face an error for fetching the group-mapping in the user-id tab. The error is normally shown up as failed to execute op command. One of the reason can be invalid credentials in the ldap configuration

Troubleshoot this error with Tail follow yes mp-log userid-log

2014-05-04 14:31:21.052 +0400 connecting to ldap://[192.168.0.199]:389 ...

2014-05-04 14:31:21.056 +0400 Error: pan_ldap_bind_simple(pan_ldap.c:393): ldap_sasl_bind result return(49) : Invalid credentials

2014-05-04 14:31:21.056 +0400 Error: pan_user_get_ldap(pan_group_selection_n.c:67): pan_ldap_bind() failed

2014-05-04 14:31:21.056 +0400 Error: cfgagent_doop_callback(pan_cfgagent.c:503): Failed to handle op command for agent:

useridd

Reconfigure the credentials in the ldap profile

After changing the credentials, the groups can be pulled.

2014-05-04 14:32:53.760 +0400 connecting to ldap://[192.168.0.199]:389 ...

2014-05-04 14:32:55.860 +0400 connecting to ldap://[192.168.0.199]:389 ..

Aamir Khan

Re: Failed to execute op command

HULK — Mon, 05 May 2014 14:43:03 GMT

Hello Aamir,

Are you using windows 2012 server in your set-up..?

Thanks

Re: Failed to execute op command

Westcon2 — Mon, 05 May 2014 18:28:21 GMT

Yes it is Server 2012.

Re: Failed to execute op command

HULK — Mon, 05 May 2014 19:24:45 GMT

Hello Aamir,

As TAC support for UID agent running on Windows 2012 is not available, Also for Terminal Server Agent on Windows 2012, I do see a feature request (FR ID : 3062) submitted to our development team.

Topic: Terminal Server Agent / Windows Server 2012 Support

Priority: High

FR ID: 3062

Please get in touch with your Palo Alto SE for the roadmap.

Apart from the above mentioned error, few customers confirmed the set-up running fine into their environment.

Refference : https://live.paloaltonetworks.com/message/27804#27804

Thanks

Re: Failed to execute op command

Westcon2 — Mon, 05 May 2014 19:31:43 GMT

I am using agent less and not the user-id agent. Besides this document is used to counter the error upon fetching the group mapping so that we can use it for Ldap authentication.

Re: Failed to execute op command

StephenLiffen — Wed, 13 Aug 2014 11:00:54 GMT

Just for anyone interested - I had an intermittent issue with the error "Failed to execute op command" which I traced to be an issue with resolving DNS. It seems a DNS request was made each time and this was not reliable.

I changed server address from FQDN to IP addresses to resolve the problem.

Steve