Getting LDAP Error

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Getting LDAP Error

L4 Transporter
Our client is having issues with LDAP connectivity.

We are trying to configure "Group Include List" in the Group Mapping Settings in User Identification but when we click on the Base DN to browse available groups, we get "Connect error".
 
Same thing showing on CLI:
 
PA-850-1(active)> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): ADMap
        Bind DN    : CN=svc_paloalto_auth,OU=Service Accounts,OU=Consult Cloud,OU=Hosted,DC=cloud,DC=local
        Base       : DC=cloud,DC=local
        Group Filter: (None)
        User Filter: (None)
        Servers    : configured 2 servers
                192.168.10.21(636)
                        Last LDAP error: Connect error
                192.168.0.25(636)
                        Last Action Time: 19 secs ago(took 0 secs)
                        Next Action Time: In 41 secs
                        Last LDAP error: Connect error
        Number of Groups: 0
 
When doing tcpdump, we can see TCP connection established on port 636 (we're using SSL), but AD server resets the connection.
Any idea how to resolve this issue?
1 accepted solution

Accepted Solutions

Hi @Mick_Ball 

 

During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

View solution in original post

11 REPLIES 11

Cyber Elite
Cyber Elite

 

Is this new setup or was it working before?

IS password configured  on the PA correct?

MP

Help the community: Like helpful comments and mark solutions.

Hi @MP18 

 

New setup but configuration matched with working solution in different data centre.

The service account for this setup resides in the same OU as the service account for the solution that does work.

Yes password is correct.

try this command please

test authentication authentication-profile LDAP-Profile username User4-LDAP password

 

MP

Help the community: Like helpful comments and mark solutions.

Hi @MP18 

 

test authentication authentication-profile LDAP-Profile username User4-LDAP password

can be used to verify username/password once LDAP connectivity has been established.

 

You can’t use the command to verify the service-account, because it requires LDAP connectivity… which is failing to connect.

L7 Applicator

do you have the ability to flip ssl off, go back to port 389, then capture packets to see if this is a SSL issue with version mismatch  or cert expiry........

 

or issues with Bind itself.

 

 

Hi @Mick_Ball 

 

During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

was this connection via Management plane?

MP

Help the community: Like helpful comments and mark solutions.

@MP18 

 

Yes.

Thanks Farzana.

MP

Help the community: Like helpful comments and mark solutions.

Hi, I'm seeing the same error in the logs. What was the fix for this?

Hi @bwadmin 

 

Please check the Traffic logs if the security policy is denying the traffic to LDAP server.

  • 1 accepted solution
  • 11493 Views
  • 11 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!