topic Re: Getting LDAP Error in General Topics

Getting LDAP Error

FarzanaMustafa — Mon, 25 Nov 2019 05:16:37 GMT

Our client is having issues with LDAP connectivity.

We are trying to configure "Group Include List" in the Group Mapping Settings in User Identification but when we click on the Base DN to browse available groups, we get "Connect error".

Same thing showing on CLI:

PA-850-1(active)> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): ADMap
        Bind DN    : CN=svc_paloalto_auth,OU=Service Accounts,OU=Consult Cloud,OU=Hosted,DC=cloud,DC=local
        Base       : DC=cloud,DC=local
        Group Filter: (None)
        User Filter: (None)
        Servers    : configured 2 servers
                192.168.10.21(636)
                        Last LDAP error: Connect error
                192.168.0.25(636)
                        Last Action Time: 19 secs ago(took 0 secs)
                        Next Action Time: In 41 secs
                        Last LDAP error: Connect error
        Number of Groups: 0

When doing tcpdump, we can see TCP connection established on port 636 (we're using SSL), but AD server resets the connection.

Any idea how to resolve this issue?

Re: Getting LDAP Error

MP18 — Mon, 25 Nov 2019 05:25:33 GMT

Is this new setup or was it working before?

IS password configured on the PA correct?

Re: Getting LDAP Error

FarzanaMustafa — Mon, 25 Nov 2019 05:27:53 GMT

Hi @MP18

New setup but configuration matched with working solution in different data centre.

The service account for this setup resides in the same OU as the service account for the solution that does work.

Yes password is correct.

Re: Getting LDAP Error

MP18 — Mon, 25 Nov 2019 05:33:36 GMT

try this command please

test authentication authentication-profile LDAP-Profile username User4-LDAP password

Re: Getting LDAP Error

FarzanaMustafa — Mon, 25 Nov 2019 05:50:56 GMT

Hi @MP18

test authentication authentication-profile LDAP-Profile username User4-LDAP password

can be used to verify username/password once LDAP connectivity has been established.

You can’t use the command to verify the service-account, because it requires LDAP connectivity… which is failing to connect.

Re: Getting LDAP Error

Mick_Ball — Mon, 25 Nov 2019 09:05:01 GMT

do you have the ability to flip ssl off, go back to port 389, then capture packets to see if this is a SSL issue with version mismatch or cert expiry........

or issues with Bind itself.

Re: Getting LDAP Error

FarzanaMustafa — Mon, 25 Nov 2019 22:21:47 GMT

Hi @Mick_Ball

During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

Re: Getting LDAP Error

MP18 — Mon, 25 Nov 2019 23:16:44 GMT

was this connection via Management plane?

Re: Getting LDAP Error

FarzanaMustafa — Tue, 26 Nov 2019 22:59:03 GMT

@MP18

Yes.

Re: Getting LDAP Error

MP18 — Tue, 26 Nov 2019 23:31:52 GMT

Thanks Farzana.

Re: Getting LDAP Error

bwadmin — Thu, 25 Feb 2021 15:28:04 GMT

Hi, I'm seeing the same error in the logs. What was the fix for this?

Re: Getting LDAP Error

FarzanaMustafa — Thu, 25 Feb 2021 22:46:34 GMT

Hi @bwadmin

Please check the Traffic logs if the security policy is denying the traffic to LDAP server.