Routing issues LDAP AD server profiles

[rcaduser]

Hi, Im trying to set up Group mapping and foudn an interesting issue that I wabnted to put out here see if theres any ideas that can help us out. This is the situation:

Hardware

• ethernet1/12 is trunk with subinterfaces
• ethernet1/12.2 vlan 2 tagged subinterface with IP = PA
• ethernet1/12.3 clan 3 tagged subinterface with IP = Y
• AD server is on vlan 3 with IP = AD
• Core swith is a Cisco Nexus
• LDAP server is on vlan 2
• PA 5050, PanOS 8.0.10

Known

• vlan 2 subinterface known to work (NTP service route ises this interface to reach our NTP server)
• vlan 3 subinterface known to work (UID agents on AD servers on vlan 3 are succesfully connected)
• Gateway interfaces for both vlans are in the Nexus core switch
• ACEs at the core have communication between vlan 2 and 3 open (known to work throughout all devices on both vlans able to communicate between each other)
• LDAP Service route set to use ethernet1/12.2 with IP = PA
• All ldap connections are using port 389
• LDAP server profile (sun type) is used for various authentication profiles succesfully

Troubleshooting:

• Noticed at first while setting up an LDAP server profile with active-directory type that it would not autopopulate the Base DN as it should. The LDAP server profile with the sun type does this succesfully
• System monitor shows an connect-ldap-server-failure error
• Ran a packet capture at the Active Directory server with these results (AD server=AD, PA vlan2=PA)
  
  • PA -> AD --- SYN
  • AD -> PA --- SYN/ACK
  • PA -> AD --- SYN (retransmission)
  • PA -> AD --- SYN  (retransmission)
  • AD -> PA --- SYN/ACK  (retransmission)
  • PA -> AD --- SYN  (retransmission)
  • AD -> PA --- SYN/ACK (retransmission)
  • AD -> PA --- RST
• Ran a packet capture on the PA with these results
  • PA -> AD --- SYN
  • PA -> AD --- SYN (retransmission)
  • PA -> AD --- SYN (retransmission)
  • PA -> AD --- SYN (retransmission)
• Pinging AD from vlan 3 subinterface (IP=Y) is succesfull
• Pinging AD from vlan 2 subinterface (IP=PA) fails on the PA side but request and reply are visible on the AD side
• Finally tested by changing the service route for the LDAP service to use vlan 3 subinterface with IP=Y
  • LDAP server profile for AD server type is succesfull
  • LDAP server profile for (LDAP)sun server type now fails in the same way

Thoughts on this behaviour? in any other scenario across our network, communication between devices on these two vlans works perfectly, why does it not with the PA?

Thanks,

-S

[Remo]

Hi @rcaduser

You have a special routing/firewall desgin here 😛 and I have some additional questions:

• Do you have a zone protection profile applied to the zones of e1/12.2 and e1/12.3? If yes, which protections are enabled?
• When you did the packet capture on the firewall, did you enable "Pre parse match"?

Right now my assumption is, that the reply traffic is an IP spoofing attack for the firewall. Because whem the firewall sends an LDAP query out of vlan 2 towards the AD, the reply traffic obviously gets also back to the interface e1/12.2. But for this reply packet the source IP is the AD server IP - an IP that belongs to vlan 3 where the firewall is also directly connected. Because of that the firewall expects traffic from AD on e1/12.3 and not on e1/12.2 so it drops the packets arriving there.

In your final test when you changed the service route you have exactly the opposite that when connecting to the sun LDAP the source is e1/12.3 and then the firewall receives a reply from a server in vlan 2 that it does not expect on e1/12.3 so it dropps it.

So solve this you could configure IP based service routes instead of feature based. Or: does the firewall really need interfaces in noth vlans when the routing is done on the core switch? In this case I would use a transport network between the firewall and the core switch instead of connecting the firewall to both vlans, but probably there are other reasons why you configured it this way.

[BPry]

@rcaduser,

Baring the other reasons why this was likely setup I'm going to agree with @Remo and say that this should be setup as one transport link between the core and the firewall, and it shouldn't have both VLANs directly connected since you're already routing on the core. Ideally at that point you would simply let the core handle the routing.