topic Re: Panorama Access Domain Admins - Not functioning 7.0.3 in General Topics

Panorama Access Domain Admins - Not functioning 7.0.3

Gun-Slinger — Mon, 02 Nov 2015 15:29:19 GMT

Currently we have been working with setting up Access Domain accounts for our server admins to have restricted RO access to traffic logs and policy rules. The configuration appears sound but all testing using either local or radius/ldap auth accounts have proven to fail. Recieving the following message each time the CORRECT password and login name are entered and clicked login. All other admin accounts using a dynamic or role-based profile work without issues.

Has anyone else seen this issue?

Re: Panorama Access Domain Admins - Not functioning 7.0.3

pulukas — Tue, 03 Nov 2015 12:48:10 GMT

Check the system log in monitor. There should be a more specific failure message there.

For RADIUS also check the log on your RADIUS server to confirm the request is reaching and being processed and passed. We generally run wireshark here so we can follow the entire transaction.

Re: Panorama Access Domain Admins - Not functioning 7.0.3

Gun-Slinger — Tue, 03 Nov 2015 17:02:24 GMT

Thanks Steve but the system logs was one of the first places I looked and it displays a successful authentication from all auth types local/radius/ldap.

Re: Panorama Access Domain Admins - Not functioning 7.0.3

OtakarKlier — Wed, 04 Nov 2015 23:58:01 GMT

I agree with pulukas, if the PAN shows a successful attempt in its logs, check the other side of things, i.e. RADIUS, LDAP, etc.

Re: Panorama Access Domain Admins - Not functioning 7.0.3

pulukas — Sat, 07 Nov 2015 14:45:10 GMT

If the monitor log shows success, and the login is actually denied this is probably a bug and you will need to open a support case on this.

For the support case a wireshark of the RADIUS transaction would be the fastest path to an ultimate solution and bug fix.

Re: Panorama Access Domain Admins - Not functioning 7.0.3

Gun-Slinger — Tue, 10 Nov 2015 14:31:18 GMT

I have had a TAC case open for the last 2 weeks and is currently status research. The issue appears to be bug related so far. LDAP and Radius are not the issue as we are having the access domain issue on local accounts and all other admin accounts (Role/Dynamic) that leverage LDAP and Radius are functioning. Once I hear back from TAC I will post an update.

Thanks

Re: Panorama Access Domain Admins - Not functioning 7.0.3

rmonvon — Tue, 10 Nov 2015 19:30:30 GMT

I am running Panorama 7.0.3 with Access Domains configured for local admin accounts. It is working fine for me. Have you tried to define a new Access Domain & admin role with a new admin login account? Maybe some parameter/setting is corrupted.