I can not join into a domain when the computer pass through PA.
This is my scennario:
PC - PaloAlto - Switch - DomainController
The PC and Domain controller are in the same Zone (trust) and I have a security rule: from zone trust, to zone trust, permit all.
I can see a lot og kerberos v5 packet with bad checksum.
Unless you have a deny all rule, you don't need a rule that specifies that from trust to trust is allowed. By default, any traffic staying in the same zone is allowed by the firewall.
Is the workstation in the same subnet as the domain controller?
Have you looked at logs for traffic originating from that source for a connection that could have been blocked? I would doubt it since it's same zone but it's good to check to be sure, there might be a block rule in your policy somewhere that blocks some of the connections.
I would also consider NAT, can the PC reach the domain controller and vice versa.
If this is a fresh install you need to setup "deny + log" as last rule (traffic is denied by default as hidden last rule but that hidden rule doesnt log the blocked traffic).
I have a default block rule for log all traffic. I do not see any block between trust and trust zone. I can see ldap and kerberos application allowed. Also I can see ldap acctive sessions in the Session log.
I configured the permit rule from/to trust zone. The Pc and DC are not in the same network, they are connected through layer 3 routing with static routes.
In the past I had troubles with multicast, this traffic was not displayed on traffic logs. I thank join into windows 2008 domain could use multicast traffic but I did not see it on the sniffed traffic on PC.
I have mount a lab (DC - PaloAlto - Client), both on same zone and I got the same error. I tried without a explicit block roule and I tried with PanOS 4.0 and 4.1 with no success.
We finally decide to open a case to PaloAlto.
What do you mean by that the are cached by the PA device?
Session offloading is as far as I understand a way to optimize resources of the FPGA/ASIC in the PA.
When you disabled session offloading I assume this is done globally, did you notice any other behaviour changes when you did this (performance decrease or such)?
I would mean, when I do a packet capture I do not see the kerberos pre-authentication packet, and If I do a port mirroring on the switch where is connected the PA or disabiling session offloading and lookin packet capture again, then I can see the kerberos pre-authentication packet.
I have a case opened in PaloAlto support to solve this problem.
Please keep us updated :-)
To me it sounds like this preauth packet somehow is incorrectly dropped (didnt match any allow policy).
If possible, will it be dropped even if you use appid:any and service:any between the two ip addresses?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!