Reason: User is not in allowlist

s.williams1 — Wed, 20 Sep 2017 17:50:11 GMT

User 'steven.williams.da' failed authentication. Reason: User is not in allowlist From: ltdlqq6h2.domain.lan

short name: domain\paloaltoadmins
source type: ldap
source: Network_Administrators

[1 ] domain\steven.williams.da

Authentication profile contains the user group paloaltoadmins using the LDAP server profile. Created user in local admin and addigned it the authetication profile. Still errors. Where can you get more details within a log for this, there has to be something deeper than this generic error.

Re: Reason: User is not in allowlist

Raido_Rattameister — Thu, 21 Sep 2017 05:01:05 GMT

So you have group domain\paloaltoadmins in your domain?

You can use command below to check what Palo thinks in which AD group user is.

Maybe you need to edit Device > User Identification > Group Mapping Settings > Group Include List

> show user user-ids match-user steven.williams.da

topic Reason: User is not in allowlist in General Topics

Reason: User is not in allowlist

Re: Reason: User is not in allowlist