topic Re: Active Directory Application in General Topics

Active Directory Application

ghostrider — Mon, 24 Oct 2016 11:50:22 GMT

Hello

I create the security policy to allow users to logon to domain by simply selecting the activedirectory application but it is not working? Should I need to allow additional applications ?

Re: Active Directory Application

cpainchaud — Mon, 24 Oct 2016 12:18:35 GMT

yes, look at applications depencies.

Re: Active Directory Application

ghostrider — Mon, 24 Oct 2016 15:03:14 GMT

Thanks. Can you please give me some direction, how can I check what other applications I must allow. I was thinking new version of PANOS, taking care of dependencies like if I want to allow fb-chat then it is under fb-base

Re: Active Directory Application

cpainchaud — Mon, 24 Oct 2016 15:10:56 GMT

sure

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-is-Application-Dependency/ta-p/54270

Re: Active Directory Application

ghostrider — Mon, 24 Oct 2016 19:44:14 GMT

Thanks. Active Directory application is showing this:

I allowed all the dependend applications as well but in logs, it is showing kerbros and dns, ntp etc as well. So I am wondering why it is not working. I really appeciate your help

Re: Active Directory Application

cpainchaud — Tue, 25 Oct 2016 14:00:21 GMT

active-directory doesn't cover necessarily cover all authentication(s) stuff, rpc or ntp. that could be too broad

you want to add kerberos, some netbios, dns and ntp as well in your rule.

Re: Active Directory Application

BPry — Tue, 25 Oct 2016 16:46:01 GMT

It's pretty important to think through exactly what you actually need to allow access to, as most things Palo tries to narrow down. The best thing is to read what it's actually going to cover either on the firewall in the GUI or by looking at applipedia which makes things a little easier to search through.

Re: Active Directory Application

ghostrider — Wed, 26 Oct 2016 16:18:12 GMT

Hello

I simply want to allow users to log on to domain when login to their pc. If I only allow activedirectory application, its not working. So there should be some application for this functionality