NTLM authentication fails

[PerTenggren]

Hi all,

I'm facing an issue with captive portal and NTLM.  The SSO (NTLM) fails and the users must enter the credentials via the web-form. I've attached print screens from Wireshark and the output from the userid.log:

PAN-OS: 8.0.1

User-ID Agent: 8.0.1-21

[2017/04/25 11:07:48, 0] utils/ntlm_auth.c:get_winbind_netbios_name(172)
could not obtain winbind netbios name!
2017-04-25 11:07:48.411 +0200 Error: pan_ntlm_handleType3Msg(pan_user_id_l3svc_ntlm.c:567): NTLM Auth failure for user got\pete vsys 1

[Raido_Rattameister]

Has it ever worked?

Browser is IE right?

You have added your firewall into AD domain right (picture below)?

[BPry]

It sounds like NTLM is just either not configured or misconfigured on your User-ID section. I would verify this and make sure that everything there is correct.

[PerTenggren]

It's IE yes, new installation. Do I really need to do that when using external User-ID servers?

[Raido_Rattameister]

Yes you need to add NTLM data that creates firewall computer object into domain and gives firewall capability to use NTLM to authenticate users.

[PerTenggren]

OK, I thought the User-ID Agent (external) acted as a proxy between the firewall and the domain controllers. 

Never the less, I’ve added the NTLM configuration on the firewall but still no luck. What I noticed is that the firewall do not join the domain. Can that be forced somehow?  

[PerTenggren · Accepted solution]

Found the issue, the User-ID service was not enabled on the interface used for redirection. 

FYI, it not needed to set the NTML parameters on the firewall if Windows User-ID agent are used. It will act as a proxy for such request.