topic difference zone between end users and domain controller on Palo alto in General Topics

difference zone between end users and domain controller on Palo alto

Chivas — Fri, 14 Sep 2018 13:08:29 GMT

Hello all,

I have a problem with palo alto PA-850. I configure domain controllers and end users diference zone. example: zone name: Server for domain controllers, and zone: User for end users.

I setup policy to allow all traffic from Zone: Server to Zone: User and from User to Server. but end users could not authenticate with domain controllers. I checked in traffic logs: To-Port: 135, 445, Aplication: Incomplete. Please help to advise

thanks

Re: difference zone between end users and domain controller on Palo alto

kiwi — Fri, 14 Sep 2018 13:44:30 GMT

Hi @Chivas,

Try following the packet with PCAPs (is the server actually getting the packet ? Is the server returning the packet correctly ?)

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data-in-the-Application/ta-p/65711

Good luck !

-Kiwi.

Re: difference zone between end users and domain controller on Palo alto

Chivas — Fri, 14 Sep 2018 14:48:53 GMT

hi Kiwi,

I checked in PCAPs, the server is not getting the packet. but from client, I can ping or tracert to the server, even access network share on the server. just cannot authenticate when end users login. Please help to advise, do I need to configure any thing

the rule i setup:

active-directory {

source zone: User;

source address: any;

user any;

destination zone: Server;

destination address: any;

category any;

application any;

service any;

action allow;

}

thanks

Re: difference zone between end users and domain controller on Palo alto

BPry — Fri, 14 Sep 2018 14:55:27 GMT

@Chivas,

What if you actually look at the session ID in the CLI; does that give you any additional insight. Your security policy looks fine as the only thing you are really doing is analyzing the zones.

Re: difference zone between end users and domain controller on Palo alto

OtakarKlier — Fri, 14 Sep 2018 16:37:21 GMT

Hello,

Application incomplete in my experience has been a routing issue. If they are on different subnets, e.g. useres and servers, make sure the routes are in place.

Regards,

Re: difference zone between end users and domain controller on Palo alto

Chivas — Tue, 18 Sep 2018 02:42:20 GMT

Thank Klier, I fixed my problem.

Re: difference zone between end users and domain controller on Palo alto

Networking2017 — Wed, 25 Aug 2021 16:12:22 GMT

What was the fix?