topic Re: NTLM authentication fails in General Topics

NTLM authentication fails

PerTenggren — Tue, 25 Apr 2017 09:22:55 GMT

Hi all,

I'm facing an issue with captive portal and NTLM. The SSO (NTLM) fails and the users must enter the credentials via the web-form. I've attached print screens from Wireshark and the output from the userid.log:

PAN-OS: 8.0.1

User-ID Agent: 8.0.1-21

[2017/04/25 11:07:48, 0] utils/ntlm_auth.c:get_winbind_netbios_name(172)
could not obtain winbind netbios name!
2017-04-25 11:07:48.411 +0200 Error: pan_ntlm_handleType3Msg(pan_user_id_l3svc_ntlm.c:567): NTLM Auth failure for user got\pete vsys 1

Re: NTLM authentication fails

Raido_Rattameister — Thu, 27 Apr 2017 18:52:53 GMT

Has it ever worked?

Browser is IE right?

You have added your firewall into AD domain right (picture below)?

Re: NTLM authentication fails

BPry — Thu, 27 Apr 2017 21:00:16 GMT

It sounds like NTLM is just either not configured or misconfigured on your User-ID section. I would verify this and make sure that everything there is correct.

Re: NTLM authentication fails

PerTenggren — Tue, 02 May 2017 16:17:38 GMT

It's IE yes, new installation. Do I really need to do that when using external User-ID servers?

Re: NTLM authentication fails

Raido_Rattameister — Tue, 02 May 2017 20:20:54 GMT

Yes you need to add NTLM data that creates firewall computer object into domain and gives firewall capability to use NTLM to authenticate users.

Re: NTLM authentication fails

PerTenggren — Thu, 04 May 2017 06:15:15 GMT

OK, I thought the User-ID Agent (external) acted as a proxy between the firewall and the domain controllers.

Never the less, I’ve added the NTLM configuration on the firewall but still no luck. What I noticed is that the firewall do not join the domain. Can that be forced somehow?

Re: NTLM authentication fails

PerTenggren — Thu, 04 May 2017 07:59:37 GMT

Found the issue, the User-ID service was not enabled on the interface used for redirection.

FYI, it not needed to set the NTML parameters on the firewall if Windows User-ID agent are used. It will act as a proxy for such request.