topic Re: Problem with domain users to log in Palo Alto's Portal in General Topics

Problem with domain users to log in Palo Alto's Portal

Hientt6 — Mon, 03 Mar 2014 10:06:42 GMT

HI all. I have the problem with domain users to log in Palo Alto's Portal. I configured as document: Admin Guide v5.0 already. However, It doesn't work correctly, domain account cannot log in. Please support me to fix this problem. Thanks

Re: Problem with domain users to log in Palo Alto's Portal

_slv_ — Mon, 03 Mar 2014 10:30:55 GMT

Are you using agent or agentless options od AD integration?

Please share with us screenshot of your LDAP profile (in domain field should be netbios name of your domain - this is common mistake)

Regards

Slawek

Re: Problem with domain users to log in Palo Alto's Portal

Hientt6 — Mon, 03 Mar 2014 11:42:29 GMT

Hi Slv,

I used agentless AD integration.

My LDAP profile Picture as below:

Palo Alto sees user accounts in domain:

However I configured domain user account to enable log on Portal of Palo Alto as below:

After that, I log in Palo Alto Portal, but error appears

This user belongs to domain.

Thanks

Regards,

Re: Problem with domain users to log in Palo Alto's Portal

_slv_ — Mon, 03 Mar 2014 11:57:00 GMT

Hi Hientt

The field with arrow is really empty?

From CLI please lunch

show user ip-user-mapping all

show user user-IDs match-user g10005

Did You see users from selected OU ?

Regards

SLawek

Re: Problem with domain users to log in Palo Alto's Portal

Hientt6 — Mon, 03 Mar 2014 12:14:15 GMT

Hi,

The field with arrow is empty.

From CLI, I typed as your comment and saw information of user accounts:

Thanks

Re: Problem with domain users to log in Palo Alto's Portal

_slv_ — Mon, 03 Mar 2014 12:27:37 GMT

Please put in Domain your netbios domain name, ie for contoso.local you should put there contoso

If You try to logon using contoso\g10005 what did you get in system logs related to logon process?

What version of PAN are You using?

I have 5.0.9 and in Device>Management>Authentication settings I have info "Authentication profile to use for non-local admins. Only RADIUS method is supported."

Maybe thsi is a problem?

Regards

Slawek

Re: Problem with domain users to log in Palo Alto's Portal

Hientt6 — Mon, 03 Mar 2014 12:38:49 GMT

Hi Slv,

I have version 5.0.8. In addition, I have domain name. For example: abc.cde.local .So What do I have to put in Domain ?

I'm from Vietnam, so I came back home. I will try later.

Thanks

Re: Problem with domain users to log in Palo Alto's Portal

_slv_ — Mon, 03 Mar 2014 12:55:42 GMT

That's good question, in my opinion please put abc.cde and try to logon using abc.cde\g10005.

I can recomendate for troubleshooting create security policy that will allow ie. accees for google.com only for g10005 user and You will see is it working or now.

Regards

Slawek