topic Re: About updating AD group membership in General Topics

About updating AD group membership

Retired Member — Fri, 20 Dec 2013 02:24:55 GMT

Hello guys

1. I configured LDAP profile and update from AD DC

2. AD group named domain-users has about 10900 user

3. Customer created new user and applied new user to domain-users group

So I tried to refresh a group-mapping information by debug command. But PAN could not be updated domain-users group information and refreshing member of group.

1. I created new group and applied new user to new group

PAN could be updated and bring a new-group with their membership.

So I have a question. How many PAN recognize a group-member from AD? or PAN has got a limit of max group membership from AD?

Thanks in advance.

Regards,

Roh

Re: About updating AD group membership

hshah — Thu, 26 Dec 2013 00:24:36 GMT

Hi Roh,

By default existing group mapping is updated after 1 hour, you can change the settings. Please refer bellow mentioned document for more details.

https://live.paloaltonetworks.com/docs/DOC-4994

Let me know if you have further questions.

Regards,

Hardik Shah

Re: About updating AD group membership

hshah — Thu, 26 Dec 2013 00:34:26 GMT

You can force group-mapping refresh with following command.

https://live.paloaltonetworks.com/docs/DOC-3294

Re: About updating AD group membership

HITSSEC — Thu, 26 Dec 2013 02:40:40 GMT

Roh,

We have a domain with 10,000 - 12,000 accounts in the domain with no issues. We have user-id agents on two servers (redundancy) polling 12 domains across a total of 39 Domain controllers without issue. Keeping in mind the group membership polling interval mentioned above in the previous posts. The polling interval is a balancing act between performance hit on the servers vs. speed of updating changes to group membership. We will add the user to the rule and commit if there is an urgency to the access request while waiting for the polling interval to update the firewall with the group membership changes (usually an addition).

Phil

Re: About updating AD group membership

Gregoux — Thu, 26 Dec 2013 11:18:32 GMT

hello

you could find more information here

https://live.paloaltonetworks.com/docs/DOC-5939

greg