Panorama 4.1.8 LDAP Failure

Reply
Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Hi Tom,

Confirming that after removing the domain entry I was able to log on with my domain account.

The bind section however - will still not populate. It has to be there thou for the authentication to work.

So step forward - but not something I will try on my firewalls :smileyhappy:

Br

Jørgen

Highlighted
L2 Linker

Re: Panorama 4.1.8 LDAP Failure

Yes, it works without "domain" entry :smileyhappy:

On prior Version it works also without this entry. So where is it used for?

Thx
Jörg

Highlighted
L4 Transporter

Re: Panorama 4.1.8 LDAP Failure

Confirmed on PA5020 that removing the "doman" entry in Kerberos resolved login issue on 4.1.8.

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Confirmed here as well on PA2050.

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Ive had to flip the "domain" entry setting back and forth to get LDAP to work correctly.

I would remove it, and it would work for a while....then I would have to add it back and then remove it to get it to work again.

Tech support has now suggested to me that I go back to version  4.1.7-h2

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Downgraded to 4.1.7h2, but the same issue popped up again.

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Wohaa. Thanks for that Chris. I was looking at upgrading not).

Small warning for people: The 4.1.8 also seems to fail VPN client connection using internal certificates. This might be related to the LDAP issue - not sure thou.

Br

Joergen

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Pretty sure The VPN certificate issue is not a bug - there was a warning/release-note issued, i got an email, that mentioned the certificate must match the name of the URL, and some extra validations that the new versions of client or gateway will do, so if your cert is not created correctly it will probably cause an issue.

https://live.paloaltonetworks.com/docs/DOC-2020

I am very curios, I still havent upgraded, but with the man-in-the-middle vulnerability noted a few days ago, i will want to upgrade sooner than later...  how many out there are using 4.1.8 with ldap auth successfully? in other words, are the issues common for everyone or is it just a few that have issues, meaning the solutions in this thread took care of it for most?

--

btw, here is the content of that email:

Announcement: GlobalProtect 1.1.7 Release Notes Announcement

created by panagent in Palo Alto Networks Live - View the announcement

GlobalProtect 1.1.7 implements enhanced checks for CA Server Certificates chain-of-trust. This change will cause some existing configurations to become invalid and may result in remote users receiving an error when connecting to the portal, or will not be able to connect if the certificate issue is present on the gateway. Before deploying the GlobalProtect Agent 1.1.7 to users, ensure that the Portal and all Gateway server certificates are valid and that the certificate Common Name (CN) fields match the FQDN or IP address of the portal and/or gateway that uses the certificate.

The SSL certificate that you use for the GlobalProtect portal/gateway should have a Common Name (CN) that matches what you configured in the portal settings. For example, if your certificate has the CN of gp.example.com, ensure that your portal configuration lists the gateway as gp.example.com and does not use an IP address and vice versa, otherwise when the GlobalProtect Agent tries to connect it will generate an error specifying that the certificate CN does not match.

Additionally, when the certificate is created, the Subject Alternative Name (SAN) must be exactly the same as the certificate's CN.  If the certificate uses the CN of the DNS name, ensure that the SAN also uses the DNS name and not the IP address. A mismatch will cause the GlobalProtect Agent to recognize that the SAN is not the same as the CN and will also produce the certificate error.

If your certificates are generated by a public certificate authority, then this will be done correctly and you should not have any issues.

Refer to the following tech note for details on configuring server certificates
https://live.paloaltonetworks.com/docs/DOC-2020.

  Announcement expires on November 25, 2012

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

Sorry to disappoint you - but the above issue is related to the GlobalProtect agent - not the firmware version on the firewall.

You can experience the problem they mention on any firmware level if you use GP 1.1.7

We saw the authentication problem on a PA with 4.1.8 (and GP 1.1.7). After downgrading to 4.1.7 (still GP 1.1.7) our VPN client certificate authentication worked again.

Br

Jørgen

Highlighted
Not applicable

Re: Panorama 4.1.8 LDAP Failure

We have been on 4.1.8 for a few weeks now and had to remove the domain entry from the Kerberos profile to correct the authentication issue when logging into the console. We use Kerberos for our PA administrator accounts.

Did not have to remove this from the LDAP profile, the LDAP profile still has the domain name but not the FQDN. We do not use Panaorama however.

We are having other issues with Group Mappings but this has not been verified as of yet as a firmware 4.1.8 issue, currently working with Tech Support to resolve. The issue is that the PA will randomly drop the group mappings for the user so then none of the rules will match to a user group and they will get our default block policy. As a temporary fix we have to clear user-cache and user-group-cache then restart user-id.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!