User-ID and child domain Global Catalog server

[Davyboy]

Hi,

I have a deployment question in regard to User-ID and multi domain.

If we are trying to pull group mappings and have user ID setup only on a child domain server through GC LDAP,  the user credentials used to login and thus pick up with the userid is in the format below.
- child.domain.com\user
- domain\user

I don't think it's possible to have two domain mapping for the same domain, this being as fqdn-domain-name/username (child.domain.com\user) and netbios/domain-name (domain\user)

But the end goal is to have both users mapped depending on how the user logs in.

Is this even possible? Internal discussions seem to agree that it is not possible.

If anyone has any input or what they could suggest as a better way, or if it can work like and how we do it? I would be greatful.

Currently running panos 7.1.6.

Regards,

Davyboy.

[jdelio]

FYI, this topic was moved from Community Feedback to the General Topics area, as discussions about Palo Alto Networks products should not be in the Community Feedback area.

[Davyboy · Accepted solution]

With help from a colleague we resolved this issue. It actually can be done with a single LDAP profile using port 3268 for the GC server connection.

If you bind to port 389, even if you bind to a Global Catalog server, your search includes a single domain directory partition. If you bind to port 3268, your search includes all directory partitions in the forest. If the server you attempt to bind to over port 3268 is not a Global Catalog server, the server refuses the bind.

Davyboy.

[MyDang]

Thanks. Limitation resolved after changing to port 3268