Active Directory help

[jbo]

Hi All,

We received our first pan 3020 Monday and I have been trying to learn about the product in order to setup for production. I'm making good progress so far, but I have run into an issue importing AD users. I setup group mapping and I'm able to see groups that were imported, but no users. What am I missing?

Thanks in advance for your help.

[jteetsel]

Hello, you need need to setup a user ID agent to collect user > IP mappings. This can be done with the internal user ID Agent built in to the device or by using the external Windows User ID Agent.

[kprakash]

Have you configured ip user mapping as well. Please configure IP user mapping on the firewall, with either the agent or the agentless feature

You can view the users using the below commands:

>show user group list

This shows the groups that are learnt from the AD

>show user group name <group-name>

This command shows the users associated to that group

BR,

Karthik

[panos]

so you use agentless system ? you configured user identification tab/user mapping  and enabled user identification on the zone you need ?

[jbo]

Currently I'm agentless. I setup the User Mapping and added server monitors for my dc's. I have Group Mapping Settings setup. LDAP is also setup, but when I click on a policy it only shows groups and no users.

[sraghunandan]

can you verify if the user mapping shows up the user, use following command to check the same

> show user ip-user-mapping all

If the user is present can you try manually type in the username i.e first couple of letters

[jbo · Accepted solution]

I just stumbled into my issue. Under "Server Profiles", "LDAP" I had domain.local in the domain field. So it was listing all of my users as domain.local\username. So when I was trying to find the users they didn't show up as domain\username. Amazing such a problem from one little field.

Thanks for all the help guys.

[_slv_]

It's because you provide domain.local - change it to domain

please read this topic

Regards

Slawek

[mbutt]

Hi Jbo,

In the ldap profile under domain it is suppose to be netbios domain name and not FQDN. If you specify a wrong netbios domain name then the mapping will be incorrect and policies will not work correctly either. The reason is it appends the netbios domain name  you specify when it mapping the users. Hope that helps.

Thanks

Numan