Group Based network policy not being blocked.

[edlyle]

Hello,

I have an openldap server setup as well as an LDAP policy and group mapping on the Palo Alto firewall.

When I run the 'show user group name "cn=employees,ou=groups,dc=brillnet,dc=com". I can see the users in the group just fine. Refer to the output below.

I am using the UserID xml api to associate group/user to ip mappings. Calls to the api are working when a user logs into the openldap server. I know this because I can see the user-id tagging in the api log, refer to the screenshot below.

I created a policy that blocks any user in the employees group referenced in the screenshots above. Refer to the output below.

However the above deny is not working. Does anyone know why this is happening?

[CosminM]

Hello,

Have you enabled User identification when you configure L3-trust security zone?

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/user-id/enable-user-id 

If you don't enable user identification on source zone, then the security policy will not take into account User-ID info.

[edlyle]

Hello,

Thank you for your reply. Yes, user identification is enabled on the trust zone. Refer to the screenshot below.