topic Re: Cannot create rules based on users in General Topics

Cannot create rules based on users

licenselu — Wed, 03 Oct 2012 07:22:17 GMT

Hi,

I've installed a new PA-500 device. I've also installed the UID-Agent and it's communicating with the Palo Alto because:

"show user ip-user-mapping" return results with many users

on monitor tab I have the users displayed

on acc tab i also statistics with users

But when i want to create rules and add a user it doesn't show any user available.

Re: Cannot create rules based on users

mikand — Wed, 03 Oct 2012 07:30:22 GMT

You need to setup the LDAP aswell for the configuration to be able to see which users and groups you have.

Re: Cannot create rules based on users

ppatel — Wed, 03 Oct 2012 07:37:50 GMT

After setting up LDAP, please verify the presence of a functioning Group Mapping configuration under Device > User Identification > Group Mapping Settings

This configuration should contain a functioning LDAP server profile assigned to the relevant virtual system with available groups

Regards

Parth

Re: Cannot create rules based on users

licenselu — Wed, 03 Oct 2012 09:16:30 GMT

Normally it sould work without configuring the LDAP server.

I've many customer that haven't configured any LDAP server and it's working.

Re: Cannot create rules based on users

ppatel — Wed, 03 Oct 2012 09:30:53 GMT

In 4.1 user Id user to group mappings are performed using LDAP and the agent performs only user to ip mappings.

Try the following :-

admin@PA> debug user-id reset user-id-manager type all

admin@PA>configure

admin@PA#commit force

admin@PA#exit

admin@PA>debug software restart user-id

Wait for a minute and try to see if you can fetch the users in the security policy.

Regards

Parth

Re: Cannot create rules based on users

licenselu — Wed, 03 Oct 2012 09:55:31 GMT

I just need user to ip mapping so no need to configure LDAP Server.

I tried the following :

admin@PA> debug user-id reset user-id-manager type all

admin@PA>configure

admin@PA#commit force

admin@PA#exit

admin@PA>debug software restart user-id

but it didn't change anything.

I'll reboot the firewall in 30 minutes.

Re: Cannot create rules based on users

licenselu — Wed, 03 Oct 2012 10:37:49 GMT

The reboot didn't change anything.