topic GlobalProtect Auth Problem after making new VSYS in General Topics

GlobalProtect Auth Problem after making new VSYS

s996kingsm — Mon, 07 Jul 2014 19:57:37 GMT

When ever we make a new vsys our global protect authentication fails with user not in allow list. Has anyone else seen this problem. We are going from one one system to 2 vsys's. ( I don't know the correct wording)

Re: GlobalProtect Auth Problem after making new VSYS

HULK — Mon, 07 Jul 2014 21:00:44 GMT

Hello,

You have only created an another VSYS on this PAN FW or configured the second VSYS with some interface and routing etc....?

This Doc might help you to understand NAT and policy in multy VSYS environment:

How to Set Up Shared Gateway and Inter VSYS

Thanks

Re: GlobalProtect Auth Problem after making new VSYS

kadak — Mon, 07 Jul 2014 21:00:49 GMT

Hello s996kingsm,

Can we make sure that the External interface, Global Protect portal, Global protect gateway, Authentication profile and LDAP server profile are a part of one Vsys (original vsys).

Thanks and regards,

Kunal Adak

Re: GlobalProtect Auth Problem after making new VSYS

s996kingsm — Mon, 07 Jul 2014 21:05:08 GMT

HULK We created another vsys and then the login broke. We fixed or unbroke it by just reverting to the previous config.

KADAK I am pretty sure they were all in the original but i will check again when we break it tonight.

Re: GlobalProtect Auth Problem after making new VSYS

HULK — Mon, 07 Jul 2014 21:17:48 GMT

Thanks for your update. You may check authd (authentication daemon) logs from FW CLI during next occurrence.

Thanks

Re: GlobalProtect Auth Problem after making new VSYS

s996kingsm — Tue, 08 Jul 2014 13:46:56 GMT

So we broke it last night doing so made the ldap configurations, authentication profile, and the authentication sequence all to shared location. We ended up fixing it by cloning our ldap configurations, authentication profile, and the authentication sequence. Once we did that we set them all to location vsys1. After that we set the GlobalProtect configuration to us our clones that were set to vsys1 instead of the shared ones and it worked.