topic Re: User-ID domain-map in General Topics

User-ID domain-map

markuskohlmeier — Tue, 08 Dec 2015 20:39:33 GMT

Hi guys.

I have a problem with a user-id setup in a large multi domain envoirment. User-ID agentd are working fine, but the user did not match against the group mapping. It looks like we have a problem with the domain map. The command debug user-id dump domain-map delivers only a empty result. We setup the group maping against the Global Catalog of the root domain.

Does anyone know which attribute Palo Alto Networks read out of the AD for the domain-map? Maybe there is an issue withe the AD.

Best regards, Markus

Re: User-ID domain-map

pankaku — Tue, 08 Dec 2015 20:50:33 GMT

Check these DOC's

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-in-a-Multi-Domain-Active/ta-=p/60784

https://live.paloaltonetworks.com/t5/Configuration-Articles/Correct-Group-and-IP-to-User-Mapping-in-Multi-domain-AD-Forest/ta-p/55505

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-for-Users-in-Multiple-Domains/ta-p/62089

https://live.paloaltonetworks.com/t5/Learning-Articles/IP-to-User-Mappings-Have-Inconsistent-Domain-Prefix/ta-p/59351

Hope this helps.

Re: User-ID domain-map

markuskohlmeier — Tue, 08 Dec 2015 21:04:45 GMT

Hi pakumar.

I know all these documents and I configured it as usual (and as described in the documents). But without success. I think my problem is the domain-map, because it should not be empty.

Best regards, Markus

Re: User-ID domain-map

pankaku — Tue, 08 Dec 2015 21:22:42 GMT

Have you added group mapping under user-identification?

Re: User-ID domain-map

markuskohlmeier — Tue, 08 Dec 2015 21:23:43 GMT

Yes, of course.

Re: User-ID domain-map

markuskohlmeier — Tue, 08 Dec 2015 21:29:06 GMT

Hi. Just to be clear, I setup user-id, also in large envoirments, several times successful. But this time I have problems with the group mapping respectively the domain-map. So it would be interesting if anyone know which AD attribute or value Palo Alto Network use as domain-map.

Thank you and best regards, Markus

Re: User-ID domain-map

pankaku — Tue, 08 Dec 2015 21:32:09 GMT

Okay try one more think change the domain name to netbios-name and test.

Re: User-ID domain-map

markuskohlmeier — Tue, 08 Dec 2015 21:33:09 GMT

Hi. I tried that allready, without success.

Re: User-ID domain-map

abjain — Wed, 09 Dec 2015 02:51:41 GMT

Hi Markus,

Can you try this:

1. Modify the LDAP server profile to use port 636 for the connection to the GC.

2. Create a new group mapping using this LDAP profile.

3. Use one group from the group list pulled from the server and put it in include list and commit the changes.

See if it helps. Else I would suggest to contact support.

Regards,

Abhishek