PaloAlto does not pass through itself a request for AD

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

PaloAlto does not pass through itself a request for AD

L1 Bithead

Hi !

I have problem with connection PC to AD between which stands PaloAlto

PC 192.168.10.10
AD 192.168.30.40 (loc.lab)
pings go from  PC  to AD 192.168.30.40 (loc.lab) and return successfully
pings go from  PC  to loc.lab (192.168.30.40) and return successfully

But when I try to connect a PC with a local account enter into the domain i get

1PC.jpeg


when i transfer pc to network 30 i successfully connect to AD


1PC.jpeg

2PC.jpeg

PA_Metwork_InterfaceMgmt.jpeg

  

PA_Network_Interface.jpeg

PA_Network_VR.jpeg

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

My guess is that the Palo Alto is blocking the traffic. Make sure there is a policy that allows the traffic to/from the Domain Controllers to the subnet the PC is on. Enable logging on all policies and use the Traffic logs to check for blocks, etc. Also from one of the screenshots, looks like the LDAP is still set to use the default ,eg the management interface.

 

Regards,

L4 Transporter

I agree with @OtakarKlier I would check for dropped traffic, although as pointed out definately in the screenshot the route for LDAP is the MGMT interface so you would have to check which firewall that traffic is going through and this is the intended route.

PCCSA PCNSA PCNSE PCSAE

L2 Linker

Hi @ArtemTokarenko 

When you say "after transfer pc to network 30 i successfully connect to AD", what is the network configured on the PC in which the connection fails?
I would check the routing table on the PC when configured in the problematic network to see if the traffic is forwarded to the firewall? (Basically, tracing the traffic)

**My understanding says -- The service-route settings is for the management-plane traffic. If we are just concerned about the traffic between PC <--> AD, then we can rest assured that the service will not be used.

 

Regards,

I think you are right that this may be simply connecting the PC to the domain, but looking at the rule base, all rules are completely open, this would suggest that any connected network that has a route to the AD server should be OK, I am just wondering if it is the PC or the firewall that the AD connection is for, if @ArtemTokarenko was not trying to connect the firewall then why show the LDAP config on it, however the error message is not from the Palo.

Could you provide some more context please @ArtemTokarenko 

PCCSA PCNSA PCNSE PCSAE
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!