Getting LDAP Error

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Getting LDAP Error

L4 Transporter
Our client is having issues with LDAP connectivity.

We are trying to configure "Group Include List" in the Group Mapping Settings in User Identification but when we click on the Base DN to browse available groups, we get "Connect error".
Same thing showing on CLI:
PA-850-1(active)> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): ADMap
        Bind DN    : CN=svc_paloalto_auth,OU=Service Accounts,OU=Consult Cloud,OU=Hosted,DC=cloud,DC=local
        Base       : DC=cloud,DC=local
        Group Filter: (None)
        User Filter: (None)
        Servers    : configured 2 servers
                        Last LDAP error: Connect error
                        Last Action Time: 19 secs ago(took 0 secs)
                        Next Action Time: In 41 secs
                        Last LDAP error: Connect error
        Number of Groups: 0
When doing tcpdump, we can see TCP connection established on port 636 (we're using SSL), but AD server resets the connection.
Any idea how to resolve this issue?

Accepted Solutions

Hi @MickBall 


During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

View solution in original post


Cyber Elite
Cyber Elite


Is this new setup or was it working before?

IS password configured  on the PA correct?


Hi @MP18 


New setup but configuration matched with working solution in different data centre.

The service account for this setup resides in the same OU as the service account for the solution that does work.

Yes password is correct.

try this command please

test authentication authentication-profile LDAP-Profile username User4-LDAP password



Hi @MP18 


test authentication authentication-profile LDAP-Profile username User4-LDAP password

can be used to verify username/password once LDAP connectivity has been established.


You can’t use the command to verify the service-account, because it requires LDAP connectivity… which is failing to connect.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!