AD Authentication Problem with Secondary Firewall

[Satish]

HI friends..

I am having two Palo Alto Network ( PAN-PA-3020 ) firewall installed in HA  mode (Active-Passive) .

  My problem is when ever my Primary FW goes down or change to passive and Secondary become Active, My Active directory authentication  becomes fails, however all other things works fine. Please suggest.Thanks

Regards

Satish

[HULK]

Hello Satish,

After the HA failover, did you check the reachability to the AD server from PAN firewall.? Also, verify authd logs for more detail information.

Thanks

[hshah]

Hi Satish,

Make sure both the devices have similar authentication configuration, because authentication configuration is not synced via failover.

Regards,

Hardik Shah

[HULK]

Reference DOC for more details info--- HA-Sync :Information Synchronized in an HA Pair

[Satish]

Hi Hardik,

let me check if i got any problem i will coordinate with you.apart from this any other configuration i need to consider??

Regards

Satish

[Satish]

Hi Hulk bro.,

Thanks for sharing such kind of use full document.

Regards

Satish

[hshah]

Hi Satish,

Most likely its happening due to configuration differences on both the boxes, verify the same.

Regards,

Hardik Shah

[Satish]

Hi Friends

I am facing such king of issue can you help me plz

[HULK]

Hello Satish,

Could you please re-configure the LDAP server credentials on this PAN firewall and let us know the result. It looks like your LDAP credentials were not configured correctly.

Thanks

[Satish]

Hi Hulk Bro..,

same configuration have primary firewall its working fine. but secondary firewall have only issue plz suggest.

Regards

Satish

[HULK]

Hello Satish,

It's not about the configuration, but LDAP credentials. Could you please try to re-enter credentials one more time on the passive node.

Thanks

[hshah]

Hi Satish,

Also try to capture traffic between AD server and Firewall, even capture can tell you whats going wrong.

As HULK said if its a authentication issue, you will be able to view in captures.

Capture is greatest friend for security engineers.

Regards,

Hardik Shah

[Satish]

Hi Hardik,

Is this required to Passive device active for the traffic capture or AD authentication verification.

If i am wrong plz correct me. buz customer are asking its not required to passive device to active for the same. 

Regards

Satish

[HULK]

Hello Satish,

I hope the AD server is connected through the management interface. Hence, you need to capture packet on the management interface. It is not necessary to bring the firewall in Active state, in order to capture packet, you can capture in Passive FW as well.

Reference DOC: tcpdump

Hope this helps.

Thanks

[Satish]

Hi Hulk Bro.,

I have re-enter credentials on the passive node. but i am facing same issue.

Regards

Satish