How to configure LDAP profile in multi-domain forest

emr_1 — Wed, 26 Jul 2017 08:06:39 GMT

Background:

-We have two domains, let's say domainA.local and domainB.local.

-Two domains are trusted each other.

-domainA is for parent company, domainB is for child company.

What I want to do:

-I want to bind to domainB.local by using user under domainA.local.

example) binduser@domainA.local

Current Result:

-I can't bind to domainB. It says Invalid Credential

Additional Info:

-If I use user@domainB for domainB.local, it works.

Questions:

-Does PAN support such environment?

-If yes, how to configure it? Do I need something special?

Sample Image that I configured:

Note:

I already read following article:

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-in-a-Multi-Domain-Active/ta-p/60784

Re: How to configure LDAP profile in multi-domain forest

RichColeman — Mon, 31 Jul 2017 09:05:52 GMT

You'll need to configure two LDAP profiles, Ideally do this from Panorama then its easier to distrupte across your estate. You can't have a single LDAP profile for two domains

topic Re: How to configure LDAP profile in multi-domain forest in General Topics

How to configure LDAP profile in multi-domain forest

Re: How to configure LDAP profile in multi-domain forest