topic Re: Routing issues LDAP AD server profiles in General Topics

Routing issues LDAP AD server profiles

rcaduser — Fri, 10 Aug 2018 20:17:02 GMT

Hi, Im trying to set up Group mapping and foudn an interesting issue that I wabnted to put out here see if theres any ideas that can help us out. This is the situation:

Hardware

ethernet1/12 is trunk with subinterfaces
ethernet1/12.2 vlan 2 tagged subinterface with IP = PA
ethernet1/12.3 clan 3 tagged subinterface with IP = Y
AD server is on vlan 3 with IP = AD
Core swith is a Cisco Nexus
LDAP server is on vlan 2
PA 5050, PanOS 8.0.10

Known

vlan 2 subinterface known to work (NTP service route ises this interface to reach our NTP server)
vlan 3 subinterface known to work (UID agents on AD servers on vlan 3 are succesfully connected)
Gateway interfaces for both vlans are in the Nexus core switch
ACEs at the core have communication between vlan 2 and 3 open (known to work throughout all devices on both vlans able to communicate between each other)
LDAP Service route set to use ethernet1/12.2 with IP = PA
All ldap connections are using port 389
LDAP server profile (sun type) is used for various authentication profiles succesfully

Troubleshooting:

Noticed at first while setting up an LDAP server profile with active-directory type that it would not autopopulate the Base DN as it should. The LDAP server profile with the sun type does this succesfully
System monitor shows an connect-ldap-server-failure error
Ran a packet capture at the Active Directory server with these results (AD server=AD, PA vlan2=PA)
- PA -> AD --- SYN
- AD -> PA --- SYN/ACK
- PA -> AD --- SYN (retransmission)
- PA -> AD --- SYN (retransmission)
- AD -> PA --- SYN/ACK (retransmission)
- PA -> AD --- SYN (retransmission)
- AD -> PA --- SYN/ACK (retransmission)
- AD -> PA --- RST
Ran a packet capture on the PA with these results
- PA -> AD --- SYN
- PA -> AD --- SYN (retransmission)
- PA -> AD --- SYN (retransmission)
- PA -> AD --- SYN (retransmission)
Pinging AD from vlan 3 subinterface (IP=Y) is succesfull
Pinging AD from vlan 2 subinterface (IP=PA) fails on the PA side but request and reply are visible on the AD side
Finally tested by changing the service route for the LDAP service to use vlan 3 subinterface with IP=Y
- LDAP server profile for AD server type is succesfull
- LDAP server profile for (LDAP)sun server type now fails in the same way

Thoughts on this behaviour? in any other scenario across our network, communication between devices on these two vlans works perfectly, why does it not with the PA?

Thanks,

-S

Re: Routing issues LDAP AD server profiles

Remo — Fri, 10 Aug 2018 23:52:14 GMT

Hi @rcaduser

You have a special routing/firewall desgin here 😛 and I have some additional questions:

Do you have a zone protection profile applied to the zones of e1/12.2 and e1/12.3? If yes, which protections are enabled?
When you did the packet capture on the firewall, did you enable "Pre parse match"?

Right now my assumption is, that the reply traffic is an IP spoofing attack for the firewall. Because whem the firewall sends an LDAP query out of vlan 2 towards the AD, the reply traffic obviously gets also back to the interface e1/12.2. But for this reply packet the source IP is the AD server IP - an IP that belongs to vlan 3 where the firewall is also directly connected. Because of that the firewall expects traffic from AD on e1/12.3 and not on e1/12.2 so it drops the packets arriving there.

In your final test when you changed the service route you have exactly the opposite that when connecting to the sun LDAP the source is e1/12.3 and then the firewall receives a reply from a server in vlan 2 that it does not expect on e1/12.3 so it dropps it.

So solve this you could configure IP based service routes instead of feature based. Or: does the firewall really need interfaces in noth vlans when the routing is done on the core switch? In this case I would use a transport network between the firewall and the core switch instead of connecting the firewall to both vlans, but probably there are other reasons why you configured it this way.

Re: Routing issues LDAP AD server profiles

BPry — Sat, 11 Aug 2018 02:49:53 GMT

@rcaduser,

Baring the other reasons why this was likely setup I'm going to agree with @Remo and say that this should be setup as one transport link between the core and the firewall, and it shouldn't have both VLANs directly connected since you're already routing on the core. Ideally at that point you would simply let the core handle the routing.