Getting LDAP Error

[FarzanaMustafa]

Our client is having issues with LDAP connectivity.

We are trying to configure "Group Include List" in the Group Mapping Settings in User Identification but when we click on the Base DN to browse available groups, we get "Connect error".

Same thing showing on CLI:

PA-850-1(active)> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): ADMap
        Bind DN    : CN=svc_paloalto_auth,OU=Service Accounts,OU=Consult Cloud,OU=Hosted,DC=cloud,DC=local
        Base       : DC=cloud,DC=local
        Group Filter: (None)
        User Filter: (None)
        Servers    : configured 2 servers
                192.168.10.21(636)
                        Last LDAP error: Connect error
                192.168.0.25(636)
                        Last Action Time: 19 secs ago(took 0 secs)
                        Next Action Time: In 41 secs
                        Last LDAP error: Connect error
        Number of Groups: 0

When doing tcpdump, we can see TCP connection established on port 636 (we're using SSL), but AD server resets the connection.

Any idea how to resolve this issue?

[MP18]

Is this new setup or was it working before?

IS password configured  on the PA correct?

[FarzanaMustafa]

Hi @MP18 

New setup but configuration matched with working solution in different data centre.

The service account for this setup resides in the same OU as the service account for the solution that does work.

Yes password is correct.

[MP18]

try this command please

test authentication authentication-profile LDAP-Profile username User4-LDAP password

[FarzanaMustafa]

Hi @MP18 

test authentication authentication-profile LDAP-Profile username User4-LDAP password

can be used to verify username/password once LDAP connectivity has been established.

You can’t use the command to verify the service-account, because it requires LDAP connectivity… which is failing to connect.

[Mick_Ball]

do you have the ability to flip ssl off, go back to port 389, then capture packets to see if this is a SSL issue with version mismatch  or cert expiry........

or issues with Bind itself.

[FarzanaMustafa · Accepted solution]

Hi @Mick_Ball 

During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

[MP18]

was this connection via Management plane?

[FarzanaMustafa]

@MP18 

Yes.

[MP18]

Thanks Farzana.

[bwadmin]

Hi, I'm seeing the same error in the logs. What was the fix for this?

[FarzanaMustafa]

Hi @bwadmin 

Please check the Traffic logs if the security policy is denying the traffic to LDAP server.