Unable to assign Security Policy to Users or Groups

[MRosloniec]

Hi -

We are using User-ID Agents to create user-to-IP mappings and I've got group mapping configured on the firewall itself and I can browse through my ldap groups.  However, when I go to Policies > Security Policy I am unable to select either individual users OR groups to assign the policy to... Nothing populates.  Am I missing something somewhere?  Seems like it would be straight forward after configuring group mapping.  Thanks!

[panos]

you can use

show shared server-profile ldap

in configure mode.

[MRosloniec]

admin@Ada-PAN-M100(primary-active)# show template "US Lab" config shared server-profile ldap LDAP-Group-Mapping

LDAP-Group-Mapping {

  server {

    ldap-adam-apps.intranet.local {

      port 389;

      address ldap-adam-apps.intranet.local;

    }

  }

  ldap-type active-directory;

  timelimit 30;

  bind-timelimit 30;

  ssl no;

  domain na;

  base ou=groups,o=alticor;

  bind-dn cn=ldap-alt-paloalto,ou=users,o=alticor;

  bind-password -AQ==ZtJUGAV/ZcKHS4UkVNe1zXA0x2s=uvilr+9UMZiJgEAXcnLCXA==;

}

[gwesson]

The M-100 (and Panorama in general) will not populate users or groups when creating rules until a rule has been created with that user/group at least once. The reason for this is because of the huge amount of load it would take if you had several hundred firewalls, each with different domains configured with a single Panorama (imagine how long it would take to query each firewall, which would query each domain, and return the full group and user list).

If you create the policy local to the firewall, the group will indeed prepopulate because the scope is limited to that one firewall's set of user and group data.

Once you create a policy which has a user- or group-name on Panorama, that user/group will be available for future rules. Note that there is no integrity check, so a mistake will be allowed through and simply fail to match. I recommend copying the user data from an LDAP browser so you don't have to worry about the syntax.

Hope this helps,

Greg Wesson

[mschuricht]

This sound like a bug...

Was the master device selected in the Device Group configuration?

User-ID groups should be pulled from the Master Device for selection in Policy and will also be queried upon search to pull individual users as well.

[MRosloniec]

Yes there is a master device set.  We went ahead and opened a case on this issue.