User-ID domain-map

[markuskohlmeier]

Hi guys.

I have a problem with a user-id setup in a large multi domain envoirment. User-ID agentd are working fine, but the user did not match against the group mapping. It looks like we have a problem with the domain map. The command debug user-id dump domain-map delivers only a empty result. We setup the group maping against the Global Catalog of the root domain.

Does anyone know which attribute Palo Alto Networks read out of the AD for the domain-map? Maybe there is an issue withe the AD.

Best regards, Markus

[pankaku]

Check these DOC's

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-in-a-Mult...

https://live.paloaltonetworks.com/t5/Configuration-Articles/Correct-Group-and-IP-to-User-Mapping-in-...

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Group-Mapping-for-Users...

https://live.paloaltonetworks.com/t5/Learning-Articles/IP-to-User-Mappings-Have-Inconsistent-Domain-...

Hope this helps.

[markuskohlmeier]

Hi pakumar.

I know all these documents and I configured it as usual (and as described in the documents). But without success. I think my problem is the domain-map, because it should not be empty.

Best regards, Markus

[pankaku]

Have you added group mapping under user-identification?

[markuskohlmeier]

Yes, of course.

[markuskohlmeier]

Hi. Just to be clear, I setup user-id, also in large envoirments, several times successful. But this time I have problems with the group mapping respectively the domain-map. So it would be interesting if anyone know which AD attribute or value Palo Alto Network use as domain-map.

Thank you and best regards, Markus

[pankaku]

Okay try one more think change the domain name to netbios-name and test.

[markuskohlmeier]

Hi. I tried that allready, without success.

[abjain]

Hi Markus,

Can you try this:

1. Modify the LDAP server profile to use port 636 for the connection to the GC.

2. Create a new group mapping using this LDAP profile.

3. Use one group from the group list pulled from the server and put it in include list and commit the changes.

See if it helps. Else I would suggest to contact support.

Regards,

Abhishek