Try and rebuild the userinfo.xml file using the following commands:
> debug user-id clear group all
> debug user-id reset group-mapping all
> debug user-id reset user-id-manager type user-group
# commit force
This will force the firewall to rebuild the userid.xml file based on a refresh from the LDAP server. If this doesn't work, give support a call so that we can take a look.
Had a remote session with PaloAlto Support.
They found out, that there is a problem/bug with the translation of the group names : Policy was entered the name "Domain\Group name" but the mapping has just the "cn= .... " format.
To "solve" the problem temporary, use the cn=.... format in the Policies.
A bug fix is the development.
What I found during our update was the PAN-OS 6.0 upgrade was treating the groups like users. Once I went through an deleted the old group and re-added them I found the the configuration line was referencing the entire LDAP search string.
We didn't have that many groups in policy so it only took an hour or so to fix.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!