topic Re: 4.1.7 Problem with Domain Users enumeration persists. in General Topics

4.1.7 Problem with Domain Users enumeration persists.

EdwinD — Fri, 17 Aug 2012 00:28:08 GMT

I am running PanOS 4.1.7 on a pair of HA 2050's which use direct LDAP connectivity to multiple AD servers for group membership. I also have the UaInstall-4.1.5-1.MSI 4.1.5 user to IP agents running on my DCs. I do not have the group membership coming from the user to IP agent running on the servers. I have the 2050's enumerating group membership directly from the AD LDAP servers, using the global connection port 5007 from the Firewall to the AD servers.

I upgrade from 4.1.5 to 4.1.7 because I am aware of the known issue in 4.1.5 with "Domain Users" not being properly enumerated. However, this problem just re-occurred in 4.1.7 to some extent. The end result is that 90% of my users no longer had Internet access.

When I ran the command

show user user-IDs | match someuser

I got no results. This problem lasted for over an hour. I have group membership refresh set to 360 seconds. I had to commit the firewall policy multiple times for the group membership to work enumerate correctly. Other groups were enumerating fine.

I would like to suggest that there is still a bug in this code in 4.1.7. For the time being I have created a new active directory group that isn't special like "domain users" is, and I have added all my domain users to it.

Re: 4.1.7 Problem with Domain Users enumeration persists.

sspringer — Sat, 27 Oct 2012 00:36:32 GMT

Hi EdwinD,

We have been able to successfully pull members of the 'Domain Users' using 4.1.7. Perhaps the issue is unique to your environment.

In order to force a full group membership refresh(as opposed to incremental), the following command can be run:

> debug user-id reset group-mapping all

Please open a case with support for further investigation if you haven't already done so.

- Stefan

Re: 4.1.7 Problem with Domain Users enumeration persists.

EdwinD — Mon, 29 Oct 2012 19:51:45 GMT

Support did resolve the issue. Apparently there are multiple ways to setup the domain, and one way works better than the other. Basically, create only one LDAP mapping per domain, and then import all the groups you desire through the single mapping. Do not create a single mapping per LDAP group.