topic Re: Active Directory Group not in dropdown in General Topics

Active Directory Group not in dropdown

bmilroy — Wed, 11 Dec 2013 12:36:25 GMT

I have created a new group in Active Directory, but the PAN doesn't show the new security group in the drop down menu (Security Policy Rule -> User.Add) when adding a new policy. Is there something more that I need to do?

Re: Active Directory Group not in dropdown

_slv_ — Wed, 11 Dec 2013 13:55:16 GMT

Please take a look in topic User Groups Seen as Users in Security Policy and new users added to that group are not getting identified.

> debug user-id reset group-mapping all (intrusive command)

This command will query the active directory server to re-build the user-group mappings from scratch.

Regards

Slawek

Re: Active Directory Group not in dropdown

bmilroy — Wed, 11 Dec 2013 14:35:12 GMT

From where do I run this script. Can I run it from the browser interface?

Re: Active Directory Group not in dropdown

bmilroy — Wed, 11 Dec 2013 15:09:44 GMT

Never mind. I ran the script.

Re: Active Directory Group not in dropdown

_slv_ — Thu, 02 Jan 2014 08:09:24 GMT

From PAN 5.0.10 fixes log:

57816—Groups were not displayed in the Allow List dropdown selection of an

Authentication Profile. This was due to changes made for an issue addressed in PAN-

OS 5.0.7 (49237). This issue has been fixed so that groups are displayed in the Allow

List dropdown selection of an Authentication Profile for single-vsys devices.

Regards

SLawek

Re: Active Directory Group not in dropdown

nbilly — Mon, 06 Jan 2014 21:47:38 GMT

Panos generates a .xml file containing users and groups used by our web front-end for listing purpose.

You can check if your new groups are present in this file with following command:

> less mp-global userinfo.xml

if not, you can try to rebuild the file (!! Disruptive actions !!):

> debug user-id clear group all

> debug software restart user-id