GlobalProtect not using AD group

[StuartFordham]

Hi,

I am running a PA-VM on AWS. It has two interfaces, one for management, one for data.

I have created an LDAP connection to our network and can log into GP using my AD credentials. So far, so good.

I need to have separation of users and assigned IPs based on group membership. I have an authentication profile with two sequences. One to match on the group that my account is a member of, the second uses local authentication.

In the GP gateway, I have the authentication set to the auth sequence (which uses the first authentication profile - the one that should match my account and group set first), and in the agent client settings, I have two entries. the first one should give me an IP address from the first range, the second entry is set to any/any and gives an IP from a different range.

When I connect, I use my username/password from AD but get an IP address from the second range.

The logs show these entries (note I have replaced the actual AD details):

1,2017/09/12 05:48:17,4E0FEDAE31E65C2,31,0x0,USERID,login,53,2017/09/12 05:48:17,0,0,0,0,,PA-VM,1,vsys1,10.7.2.10,xx\sfordham,,0,1,2592000,0,0,vpn-client,globalprotect,0,0,,2017/09/12 05:48:18,1

admin@PA-VM> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): SaaS-Users
Bind DN : CN=xxx,OU=xxx xxx - Shared,DC=XX,DC=xxx
Base : DC=XX,DC=xxx
Group Filter: (None)
User Filter: (None)
Servers : configured 1 servers
213.78.96.130(389)
Last Action Time: 1607 secs ago(took 0 secs)
Next Action Time: In 1993 secs
Number of Groups: 1
cn=replaced_xxx,ou=security groups with mailbox,ou=security groups - shared,dc=xx,dc=xxx

admin@PA-VM>

admin@PA-VM> show user ip-user-mapping all

IP Vsys From User IdleTimeout(s) MaxTimeout(s)
--------------- ------ ------- -------------------------------- -------------- -------------
10.7.2.10 vsys1 GP xx\sfordham 2591689 2591689
Total: 1 users

admin@PA-VM>

From what I have read, GP in the above command *should* be AD

admin@PA-VM> show user user-ids

User Name Vsys Groups
------------------------------------------------------------------
xx.xxx\sfordham vsys1 cn=replaced_xxx,ou=security groups with mailbox,ou=security groups - shared,dc=xx,dc=xxx
Total: 22
admin@PA-VM>

So it looks like it is reading all of the necessary details - I can log in using my AD account, for example - it's just the mapping that's incorrect.

Can anyone advise? 

Apologies if I have missed something blindingly obvious. I only started working with PA last week, so am learning as I go!

[Mick_Ball]

firstly, check the monitor\system log to ensure you are authenticating as domain\user name to both the portal and gateway.

[Mick_Ball]

sorry, cancel the above....

[StuartFordham]

Ok, cancelling... but here are the logs just in case...

[Mick_Ball]

could you confirm that under network/gateways/(gateway name)/agent    that you have 2 configs.

[Mick_Ball]

oops.. missed off /client settings

[StuartFordham]

Check! both are there, and I am getting an IP address from the Corp pool - not the first pool as I would like...

[Mick_Ball]

open up your first config and add another user, start typing sford and see if your name auto appears

[StuartFordham]

That works:

[Mick_Ball]

could you provide print screen of ldap auth profile

[StuartFordham]

I this what you mean?

there are no settings under "Factors"

[Mick_Ball]

ok i'm not so good with domain names, we do not have a something.local in our domain name. just a single entry.

hopefully someone else will jump in with more domain experience but could you just post device/user id/group mapping settings/(name)/server profile.

also.. under the gateway client settings, just enter your name manually without domain info. and test.

[StuartFordham]

The only difference I can see is that the domain is uppercase here - but I can drill into it and select the group, so I think this is probably not causing an issue.

I added myself as a new entry as you suggested:

However, I still get an IP address from the 10.7.2. range.

[Mick_Ball]

you have added yourself with domain info.  dont select yourself from the list, just type it in and ignore name in list. just click whitespace and it will stick.

[StuartFordham]

Tried that, it just shows sfordham, but I still jump down to the Corp entry.