Group mapping with open Ldap in PAN-OS 6.0.1

Gregoux — Tue, 25 Mar 2014 12:13:21 GMT

Hi we meet an issue with an upgrade from version 5.0.11 to version 6.0.1

with the version 5.0.11 we could list the user associate in the group with the command

show user group name "cn=groupe1,ou=groups,dc=mydom,dc=com "

but after upgrade no user is list with this command

is it normal?

Re: Group mapping with open Ldap in PAN-OS 6.0.1

Phoenix — Tue, 25 Mar 2014 16:40:40 GMT

Hello Gregoux,

Some of the troubleshooting steps to find the users in the group

1> debug user-id refresh group-mapping <options>

2> debug user-id reset group-mapping all

3> Look for resources consumed

" show system resources | match useridd"

4> If needed to restart the user id process

"debug software restart user-id"

5> If there are group mapping profiles configured and have selected certain groups to be included to be fetched and monitored.

Try to remove the group mapping profile so that the firewall will fetch all the groups. Once done check and see if the users are populating in the groups.

Hope this helps.

topic Group mapping with open Ldap in PAN-OS 6.0.1 in General Topics

Group mapping with open Ldap in PAN-OS 6.0.1

Re: Group mapping with open Ldap in PAN-OS 6.0.1