Unable to Apply Group based Security Policy

[Mebinbaby]

Hello Team,

We have successfully integrated LDAP with the Palo Alto firewall, and user-ID mapping via the user-ID agent is functioning as expected. We are able to use LDAP users in the security policy without any issues. However, when attempting to apply LDAP groups to the policy, the policy does not seem to work as intended.

We have configured the group mapping correctly, and when we check the user list within the group via CLI, it displays accurately.

Could you please assist us with your expertise to resolve this issue.

[TomYoung]

Hi @Mebinbaby ,

The most common reason, by far, for group mappings not to work is that the format of the user name in the IP mapping is different from the format of the username in the group mapping.  The username must match exactly.  You can run the following commands to verify the format is exactly the same:

> show user ip-user-mapping all
> show user group list
> show user group name "cn=it_operations,cn=users,dc=al,dc=com"

Obviously, replace the group name above with the one in question.  😀  If there are spaces in the group name, it must be in quotes.

If the formats are different, please post and we can look at resolving it.  Please also post the source of the User/IP mappings.  If the source involves an authentication profile, please post the type.

Thanks,

Tom