topic Re: AD Authentication Problem with Secondary Firewall in General Topics

AD Authentication Problem with Secondary Firewall

Satish — Mon, 28 Jul 2014 15:56:34 GMT

HI friends..

I am having two Palo Alto Network ( PAN-PA-3020 ) firewall installed in HA mode (Active-Passive) .

My problem is when ever my Primary FW goes down or change to passive and Secondary become Active, My Active directory authentication becomes fails, however all other things works fine. Please suggest.Thanks

Regards

Satish

Re: AD Authentication Problem with Secondary Firewall

HULK — Mon, 28 Jul 2014 16:03:56 GMT

Hello Satish,

After the HA failover, did you check the reachability to the AD server from PAN firewall.? Also, verify authd logs for more detail information.

Thanks

Re: AD Authentication Problem with Secondary Firewall

hshah — Mon, 28 Jul 2014 16:03:58 GMT

Hi Satish,

Make sure both the devices have similar authentication configuration, because authentication configuration is not synced via failover.

Regards,

Hardik Shah

Re: AD Authentication Problem with Secondary Firewall

HULK — Mon, 28 Jul 2014 16:07:19 GMT

Reference DOC for more details info--- HA-Sync :Information Synchronized in an HA Pair

Re: AD Authentication Problem with Secondary Firewall

Satish — Mon, 28 Jul 2014 16:12:14 GMT

Hi Hardik,

let me check if i got any problem i will coordinate with you.apart from this any other configuration i need to consider??

Regards

Satish

Re: AD Authentication Problem with Secondary Firewall

Satish — Mon, 28 Jul 2014 16:14:32 GMT

Hi Hulk bro.,

Thanks for sharing such kind of use full document.

Regards

Satish

Re: AD Authentication Problem with Secondary Firewall

hshah — Mon, 28 Jul 2014 16:16:34 GMT

Hi Satish,

Most likely its happening due to configuration differences on both the boxes, verify the same.

Regards,

Hardik Shah

Re: AD Authentication Problem with Secondary Firewall

Satish — Tue, 29 Jul 2014 06:47:51 GMT

Hi Friends

I am facing such king of issue can you help me plz

Re: AD Authentication Problem with Secondary Firewall

HULK — Tue, 29 Jul 2014 07:03:50 GMT

Hello Satish,

Could you please re-configure the LDAP server credentials on this PAN firewall and let us know the result. It looks like your LDAP credentials were not configured correctly.

Thanks

Re: AD Authentication Problem with Secondary Firewall

Satish — Tue, 29 Jul 2014 08:58:38 GMT

Hi Hulk Bro..,

same configuration have primary firewall its working fine. but secondary firewall have only issue plz suggest.

Regards

Satish

Re: AD Authentication Problem with Secondary Firewall

HULK — Tue, 29 Jul 2014 13:58:29 GMT

Hello Satish,

It's not about the configuration, but LDAP credentials. Could you please try to re-enter credentials one more time on the passive node.

Thanks

Re: AD Authentication Problem with Secondary Firewall

hshah — Tue, 29 Jul 2014 14:20:26 GMT

Hi Satish,

Also try to capture traffic between AD server and Firewall, even capture can tell you whats going wrong.

As HULK said if its a authentication issue, you will be able to view in captures.

Capture is greatest friend for security engineers.

Regards,

Hardik Shah

Re: AD Authentication Problem with Secondary Firewall

Satish — Wed, 30 Jul 2014 09:06:16 GMT

Hi Hardik,

Is this required to Passive device active for the traffic capture or AD authentication verification.

If i am wrong plz correct me. buz customer are asking its not required to passive device to active for the same.

Regards

Satish

Re: AD Authentication Problem with Secondary Firewall

HULK — Wed, 30 Jul 2014 09:15:30 GMT

Hello Satish,

I hope the AD server is connected through the management interface. Hence, you need to capture packet on the management interface. It is not necessary to bring the firewall in Active state, in order to capture packet, you can capture in Passive FW as well.

Reference DOC: tcpdump

Hope this helps.

Thanks

Re: AD Authentication Problem with Secondary Firewall

Satish — Wed, 30 Jul 2014 09:37:44 GMT

Hi Hulk Bro.,

I have re-enter credentials on the passive node. but i am facing same issue.

Regards

Satish