topic Re: Active directory 2012 R2 integration with PAN os 5.0.9 in General Topics

Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Fri, 11 Jul 2014 07:06:40 GMT

Hi All,

I've Palo Alto 5050 Active/Active Vwire deployment. the deployment was integrated with Active directory 2008 R2, but now I installed Active directory 2012 R2.

but Palo Alto can't see the users in Acitve Directory 2012 R2.

Any help about that please..

Regards,

Re: Active directory 2012 R2 integration with PAN os 5.0.9

pulukas — Fri, 11 Jul 2014 10:38:51 GMT

Which user-id method are you using to get the associations?

Are there any logs or messages in the server event log if you have the local agent, or on the firewall system logs?

Re: Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Fri, 11 Jul 2014 11:01:10 GMT

Hello Steven,

I'm using the PA Local agent

and the configuration is below

when I was using AD 2008 R2 all was working perfectly, but when I migrated to AD 2012 R2 nothing is working, even the Active directory administrators Login.

Regards,

Maher

Re: Active directory 2012 R2 integration with PAN os 5.0.9

pulukas — Fri, 11 Jul 2014 11:27:41 GMT

If even the AD login does not work, I'm thinking this is on the Server side.

On a local install, was the installer run as administrator and the agent have administrator rights?

If queried from a remote computer to the AD, has the Windows Server built in firewall been configured to permit the connection?

Re: Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Fri, 11 Jul 2014 11:40:52 GMT

for the first point, actually that isn't server side issue. as the server supports the connection to all other Network and security appliances in our organization.

for the agent, I'm using the Local PA agent which resides on the appliance, and communicates with Active directory using admin account. and no firewall is enabled on the active directory.

Regards,

Re: Active directory 2012 R2 integration with PAN os 5.0.9

MarcoLeckel — Fri, 11 Jul 2014 13:40:29 GMT

Try the IP of your AD as network Address instead of FQDN cealad02.centamin.local

maybe your Firewall cannot resolve the FQDN.

Although reenter your WMI Admin Credentials.

(not in LDAP Server Profile but in local User Agent)

If this does not help, open a Support Case.

Regards

Marco

Re: Active directory 2012 R2 integration with PAN os 5.0.9

AlexAState — Fri, 11 Jul 2014 13:47:43 GMT

did you try to enable SSL?

I also noticed that you use global catolog ports, is that intended? the LDAP ports are 389 and 636 (SSL)

Re: Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Fri, 11 Jul 2014 15:55:19 GMT

Hello Marco,

I already tried to set the AD config using the IP address, and it didn't work too, although I tried to check reachability using the FQDN using ping and it works properly.

and for the Admin credentials, it's configured in both the LDAP profile and the Local Agent.

Regards,

Re: Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Fri, 11 Jul 2014 16:02:08 GMT

Hi Alexa,

no I'm not using SSL on the servers, so I didn't configure the connection to use ssl. also I use the Global catalog ports because the LDAP server is GC.

Regards,

Maher

Re: Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Fri, 11 Jul 2014 16:05:59 GMT

Dears,

I would like to know if OS 5.0.9 support integration with LDAP 2012 R2.

can any one provide any article?

Regards,

Re: Active directory 2012 R2 integration with PAN os 5.0.9

pulukas — Fri, 11 Jul 2014 22:14:07 GMT

There is no update documentation for server 2012. And as you note, the global catalog really has not changed so there should be no difference for you.

this is the most recently updated User-id Best practices from March of 2014. And you GC configuration does seem to match the example.

User-ID Best Practices - PAN-OS 5.0, 6.0

Re: Active directory 2012 R2 integration with PAN os 5.0.9

homicidedart — Sat, 12 Jul 2014 03:34:42 GMT

Thanks Steven.

I did resolved the Issue by removing the configuration and configure it from scratch.

Regards,

Maher