Currently, I am using GlobalProtect in my network.
Also, I am configuring an Active Directory Server, and I would like to use AD users to connect to GlobalProtect (currently I'm using local users / groups in the firewall). Computers are not in the domain yet.
I have followed this tutorial : https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Active-Directory-Server....
When I verify connection to the LDAP server (with command: show user group name domain\usersgroup1), I've all my users.
But when I try to connect to GlobalProtect with an AD user, it's doesn't work and I have this error message in System logs: Authentification failed : Invalid username or password.
Have you got any idea to solve the problem ?
Thanks all !
This is details of my configuration :
LDAP Server Profile:
This is my Authentification profile :
And this is the GlobalProtect Authentication configuration:
Very well documented post!
1) If you are entering the domain yourself, under Authentication profile->User domain, then put the user modifier as %username% only.
2) If step (1) doesn't work, then run:
> tail follow yes mp-log authd.log
and then try to authenticate. Copy and paste those logs here.
In the Group Mapping --> Domain Setting --> User Domain, include only your NetBios name or leave it blank, for instance: in your example it is domain.ad, so leave it as domain
In the Authentication Profile User Domain field, either remove it completely or also include only your NetBios.
Both actions should resolve this issue for you.
I hope this helps.
Use Authentication Sequence profile instead of separate local and LDAP logins, and remove the user domain from the group mapping & auth profile.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!