topic Re: SSL-VPN with Active Directory auth in General Topics

SSL-VPN with Active Directory auth

convex — Thu, 01 Sep 2011 14:25:19 GMT

Hello,

I'm trying to configure SSL-VPN with Active Directory authentication.I'm running PANOS 4.0.4, and SSL-Client 1.3.0 and 1.3.1.

I've configured the following:

1. An Server Profile with type Active Directoy

2. An Authentication Profile with LDAP authentication, and using the profile I've created at step 1. Also add a group and some users to the Allow List.

3. At User Identification I have enabled the LDAP server, sing the profile I've created at step 1.

PaloAlto can connect the LDAP server. I can see the groups and users. The CLI command show user ldap-server server all shows that this connection is as supposed to be ...

I have also created the tunnel SSL-VPN, and it is working OK if I use local users. When I change this configuration to use the profile with Active Directory users, I can not connect any of the users that are on the Allow List. Allways have the same error: Authentication failed: Invalid username or password.

I use DOMAIN\USER as user at the name field of NetConnect.

Can anyone help me with this problem?

Best regards,

Nuno Carrilho

Re: SSL-VPN with Active Directory auth

jleung — Thu, 01 Sep 2011 15:30:42 GMT

Hi,

You should not need to put the domain in the login name. You can also try to use Kerberos for SSLVPN.

Re: SSL-VPN with Active Directory auth

convex — Fri, 02 Sep 2011 08:35:44 GMT

Hi, jleung,

I've also tried without the DOMAIN at the beggining. I always have the same error. It just does not work ...

Thanks,

Nuno Carrilho

Re: SSL-VPN with Active Directory auth

jleung — Fri, 02 Sep 2011 14:55:44 GMT

Hi,

Would you check the attached LDAP config technote to see if you have configure the setting correctly?

Actually I will recommend you to use Kerboros instead of LDAP. If you are using LDAP for SSLVPN and AD for internal network auth, you will have two kinds of user groups- AD group and LDAP group, and so for the same user group you may need to have two groups in the setting. But if you are using Kerboros, you only need to manage one AD user group. You can try it.

Re: SSL-VPN with Active Directory auth

convex — Mon, 05 Sep 2011 09:36:59 GMT

Hi jleung,

eDirectory and LDAP authentication in PANOS 3 1.pdf - This was the document I have followed to configure LDAP Authentication.

I have opened a case through our Palo Alto dealer, so I'm waiting for an answer from Palo Alto. I have configured alot of other AD/LDAP integrations with other Firewalls (non PaloAlto) and I never had so much trouble integrating it ...

Thanks for your help,

Nuno Carrilho

Re: SSL-VPN with Active Directory auth

convex — Wed, 07 Sep 2011 16:19:50 GMT

Hi jleung,

After long hours trying to understand this issue, finaly I found the solution. It is already working with AD.

Thanks for your help,

Re: SSL-VPN with Active Directory auth

jleung — Fri, 09 Sep 2011 13:48:46 GMT

Hi,

Great to hear that!!!

Re: SSL-VPN with Active Directory auth

ocampos — Fri, 23 Sep 2011 17:49:02 GMT

Hi convex,

We are have the same problem, could you help us with the solution?

Best regards,

Re: SSL-VPN with Active Directory auth

gswcowboy — Sun, 25 Sep 2011 10:53:20 GMT

How are users logging in? Are they entering 'Domain\User' when they log in? Can you provide a snippet of the authd logs for the failed login attempts?

Regards,

Renato

Re: SSL-VPN with Active Directory auth

convex — Mon, 26 Sep 2011 08:24:51 GMT

Helll OCAMPOS,

The first thing I have done, was to check if the AD tree plus user and password to access the AD Server where correct. You can see that at the Dashboard on the GUI with the message:

"ldap cfg [name of the ad server] connected xxx.xxx.xxx.xxx:389, initiated by: zzz.zzz.zzz.zzz"

The above message means that Palo Alto FW can connect to the AD server with the right credencials.

Than it camed the real problem, which I find out running the folowing command:

admin@PA-500> telnet port 389 host xxx.xxx.xxx.xxx

where xxx.xxx.xxx.xxx is the IP address of the AD server.

Can you post the result?

Best regards,

Nuno Carrilho