Active Directory Application

[ghostrider]

Hello 

I create the security policy to allow users to logon to domain by simply selecting the activedirectory application but it is not working? Should I need to allow additional applications ?

[cpainchaud]

yes, look at applications depencies.

[ghostrider]

Thanks. Can you please give me some direction, how can I check what other applications I must allow. I was thinking new version of PANOS, taking care of dependencies like if I want to allow fb-chat then it is under fb-base

[cpainchaud]

sure

https://live.paloaltonetworks.com/t5/Learning-Articles/Tips-amp-Tricks-What-is-Application-Dependenc...

[ghostrider]

Thanks. Active Directory application is showing this:

I allowed all the dependend applications as well but in logs, it is showing kerbros and dns, ntp etc as well. So I am wondering why it is not working. I really appeciate your help

[cpainchaud]

active-directory doesn't cover necessarily cover all authentication(s) stuff, rpc or ntp. that could be too broad

you want to add kerberos, some netbios, dns and ntp as well in your rule.

[BPry]

It's pretty important to think through exactly what you actually need to allow access to, as most things Palo tries to narrow down. The best thing is to read what it's actually going to cover either on the firewall in the GUI or by looking at applipedia which makes things a little easier to search through. 

[ghostrider]

Hello

I simply want to allow users to log on to domain when login to their pc. If I only allow activedirectory application, its not working. So there should be some application for this functionality