difference zone between end users and domain controller on Palo alto

[Chivas]

Hello all,

I have a problem with palo alto PA-850. I configure domain controllers and end users diference zone. example: zone name: Server for domain controllers, and zone: User for end users.

I setup policy to allow all traffic from Zone: Server to Zone: User and from User to Server. but end users could not authenticate with domain controllers.  I checked in traffic logs: To-Port: 135, 445, Aplication: Incomplete. Please help to advise

thanks

[kiwi]

Hi @Chivas,

Try following the packet with PCAPs (is the server actually getting the packet ? Is the server returning the packet correctly ?)

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data...

Good luck !

-Kiwi.

[Chivas]

hi Kiwi,

I checked in PCAPs, the server is not getting the packet. but from client, I can ping or tracert to the server, even access network share on the server. just cannot authenticate when end users login. Please help to advise, do I need to configure any thing

the rule i setup:

active-directory {

         source zone: User;

        source  address: any;

        user any;

        destination zone: Server;

        destination address: any;

        category any;

        application any;

        service any;

        action allow;

}

thanks

[BPry]

@Chivas,

What if you actually look at the session ID in the CLI; does that give you any additional insight. Your security policy looks fine as the only thing you are really doing is analyzing the zones.  

[OtakarKlier · Accepted solution]

Hello,

Application incomplete in my experience has been a routing issue. If they are on different subnets, e.g. useres and servers, make sure the routes are in place.

Regards,

[Chivas]

Thank Klier, I fixed my problem.

[Networking2017]

What was the fix?