- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
07-03-2013 07:31 AM
Hello all:
I am trying to configure an user in a security policy but when I write the first 4 letters of his username it doesn't appear (screenshoot attached). However, it does appear throug CLI:
admin@PA1(active)> show user ip-user-mapping all | match mmlu
10.161.34.189 vsys1 UIA idc\mmluque 3516 3516
Any clue about the problem?.
Thanks so much,
Best regards
07-03-2013 10:05 AM
The ip-user mapping is received through the agent. If you need to use groups/users in the policy make sure to configure group mapping on the device: Device -> User Identification -> Group Mapping Settings
07-08-2013 02:42 AM
Hello:
I launched the 3 commands but the problem persists, I see the user through CLI but not in web-ui.
Regards
07-08-2013 05:54 AM
Hello Comip,
It appears that there is a mismatch between the group names that is being fetched from the agent, and from the firewall when it talks directly to the LDAP server for group mapping. Do you have any "Domain" name configured under the LDAP server settings? If so, can we delete the domain name and commit the changes, and see if it makes a difference?
Thanks and best regards,
Karthik RP
07-08-2013 06:00 AM
I have the domain 'idc' configured in 'Domain' field. I manage Palo Alto through Global Protect VPN authenticated through LDAP and if I delete the idc in that field, I am not be able to authenticate through Global Protect, my user appears as 'invalid user'.
Best regards
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!