GlobalProtect not using AD group

[StuartFordham]

Hi,

I am running a PA-VM on AWS. It has two interfaces, one for management, one for data.

I have created an LDAP connection to our network and can log into GP using my AD credentials. So far, so good.

I need to have separation of users and assigned IPs based on group membership. I have an authentication profile with two sequences. One to match on the group that my account is a member of, the second uses local authentication.

In the GP gateway, I have the authentication set to the auth sequence (which uses the first authentication profile - the one that should match my account and group set first), and in the agent client settings, I have two entries. the first one should give me an IP address from the first range, the second entry is set to any/any and gives an IP from a different range.

When I connect, I use my username/password from AD but get an IP address from the second range.

The logs show these entries (note I have replaced the actual AD details):

1,2017/09/12 05:48:17,4E0FEDAE31E65C2,31,0x0,USERID,login,53,2017/09/12 05:48:17,0,0,0,0,,PA-VM,1,vsys1,10.7.2.10,xx\sfordham,,0,1,2592000,0,0,vpn-client,globalprotect,0,0,,2017/09/12 05:48:18,1

admin@PA-VM> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): SaaS-Users
Bind DN : CN=xxx,OU=xxx xxx - Shared,DC=XX,DC=xxx
Base : DC=XX,DC=xxx
Group Filter: (None)
User Filter: (None)
Servers : configured 1 servers
213.78.96.130(389)
Last Action Time: 1607 secs ago(took 0 secs)
Next Action Time: In 1993 secs
Number of Groups: 1
cn=replaced_xxx,ou=security groups with mailbox,ou=security groups - shared,dc=xx,dc=xxx

admin@PA-VM>

admin@PA-VM> show user ip-user-mapping all

IP Vsys From User IdleTimeout(s) MaxTimeout(s)
--------------- ------ ------- -------------------------------- -------------- -------------
10.7.2.10 vsys1 GP xx\sfordham 2591689 2591689
Total: 1 users

admin@PA-VM>

From what I have read, GP in the above command *should* be AD

admin@PA-VM> show user user-ids

User Name Vsys Groups
------------------------------------------------------------------
xx.xxx\sfordham vsys1 cn=replaced_xxx,ou=security groups with mailbox,ou=security groups - shared,dc=xx,dc=xxx
Total: 22
admin@PA-VM>

So it looks like it is reading all of the necessary details - I can log in using my AD account, for example - it's just the mapping that's incorrect.

Can anyone advise? 

Apologies if I have missed something blindingly obvious. I only started working with PA last week, so am learning as I go!

[StuartFordham]

Hi Mick,

Hope you had a good weekend.

The good news is that I think I now have a working solution. My basic tests (two groups with one user in each) are passing my (basic) policies.

I did have to play around with adding the domain name as the policy seemed to jump to a permit all/all - but I found this: https://live.paloaltonetworks.com/t5/Management-Articles/User-does-not-Match-Correct-Policy-but-is-L... and once got that sorted, now have the desired effect:

Many many many thanks for all your help.

I think I owe you a beer or two! 

[Mick_Ball]

Stuart, hi, and you..

no problem.... please note as per my earlier comment that you may (when fully up and running) need to add a second ip pool to your gateway settings.

with your current pool, any user visiting a toyota garage and using wifi will fail GP VPN.

they use 10.0.0.0/8, this will overlap your 10.7.1.x/x.

I encountered this issue from many othe public wifi services.

so... we have  10.50 and a 172.50 pools allocated for our users.

https://live.paloaltonetworks.com/t5/tkb/articleprintpage/tkb-id/ConfigurationArticles/article-id/25...

good luck....