Getting LDAP Error

Reply
Highlighted
L4 Transporter

Getting LDAP Error

Our client is having issues with LDAP connectivity.

We are trying to configure "Group Include List" in the Group Mapping Settings in User Identification but when we click on the Base DN to browse available groups, we get "Connect error".
 
Same thing showing on CLI:
 
PA-850-1(active)> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): ADMap
        Bind DN    : CN=svc_paloalto_auth,OU=Service Accounts,OU=Consult Cloud,OU=Hosted,DC=cloud,DC=local
        Base       : DC=cloud,DC=local
        Group Filter: (None)
        User Filter: (None)
        Servers    : configured 2 servers
                192.168.10.21(636)
                        Last LDAP error: Connect error
                192.168.0.25(636)
                        Last Action Time: 19 secs ago(took 0 secs)
                        Next Action Time: In 41 secs
                        Last LDAP error: Connect error
        Number of Groups: 0
 
When doing tcpdump, we can see TCP connection established on port 636 (we're using SSL), but AD server resets the connection.
Any idea how to resolve this issue?

Accepted Solutions
Highlighted
L4 Transporter

Hi @MickBall 

 

During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

View solution in original post


All Replies
Highlighted
Cyber Elite

 

Is this new setup or was it working before?

IS password configured  on the PA correct?

MP
Highlighted
L4 Transporter

Hi @MP18 

 

New setup but configuration matched with working solution in different data centre.

The service account for this setup resides in the same OU as the service account for the solution that does work.

Yes password is correct.

Highlighted
Cyber Elite

try this command please

test authentication authentication-profile LDAP-Profile username User4-LDAP password

 

MP
Highlighted
L4 Transporter

Hi @MP18 

 

test authentication authentication-profile LDAP-Profile username User4-LDAP password

can be used to verify username/password once LDAP connectivity has been established.

 

You can’t use the command to verify the service-account, because it requires LDAP connectivity… which is failing to connect.

Highlighted
L7 Applicator

do you have the ability to flip ssl off, go back to port 389, then capture packets to see if this is a SSL issue with version mismatch  or cert expiry........

 

or issues with Bind itself.

 

 

Highlighted
L4 Transporter

Hi @MickBall 

 

During some further troubleshooting yesterday, I found that the Palo Alto was actually denying the SSL connection to the LDAP server and sending RST to in both directions.

All is good now.

Thanks for your help.

View solution in original post

Highlighted
Cyber Elite

was this connection via Management plane?

MP
Highlighted
L4 Transporter

@MP18 

 

Yes.

Highlighted
Cyber Elite

Thanks Farzana.

MP
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!