topic Re: Authentication issue in General Topics

Authentication issue

Joshan_Lakhani — Mon, 20 Jul 2020 11:50:15 GMT

i have recently upgrade my firewall from 8.1.16 h3 to 8.1.13 h3. When the user connected with Global protect after sometime user is unable to access the application infect global protect show it's connected. when i saw in monitoring traffic it's show user domain have change the name from abc\abc to abc.com\abc. when i disconnect the GP and again connect every thing is working fine but after couple of minute same issue again happens. Once i change the in security policy of user any and give the specific GP ip every ting is working fine. so the issue is with Authentication profile.As we have 2 different domain (abc\abc located in XYZ) and other (abc.com\abc located in BCD).Iam using the User-id agent. Please suggest me how can i specific both domain in authentication profile.So that if the Domain will change but the connectivity will still connected. Previously i have add one on domain but it's working for both domain.

i have 3220 GP agent is 5.1.3

Re: Authentication issue

BPry — Mon, 20 Jul 2020 20:38:45 GMT

@Joshan_Lakhani,

Sounds like you haven't set the primary username attribute.

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-release-notes/pan-os-8-1-release-information/changes-to-default-behavior/user-id-changes.html

Re: Authentication issue

Joshan_Lakhani — Mon, 20 Jul 2020 20:44:35 GMT

i have set the primary sAMAccountName and alternate username as userPrincipalName

As iam using UIA 8.1.1-77

Re: Authentication issue

Joshan_Lakhani — Tue, 21 Jul 2020 05:54:56 GMT

Is it bug in user id agent

Re: Authentication issue

Joshan_Lakhani — Mon, 27 Jul 2020 18:51:12 GMT

After the upgrade the User-ID-Agent as there was a bug related to normalizing usernames correctly due to a domain map and fixed in 8.1.4 version. After the issue has been resolved

Bug-ID: WINAGENT-391

https://docs.paloaltonetworks.com/pan-os/8-1/user-id-agent-release-notes/user-id-agent-8-1-release-information/user-id-agent-8-1-addressed-issues