Access Domains and context switching

[laurence64]

HI All,

I have configured access domains to control read only access to certain device groups, but the context switching is not working, I have configured a Admin Role locally, added the user to the local device with an admin role, even added the username as the device and vsys role to see if that would work, the log output from #tail follow yes mp-log authd.log shows that the user logs in and that role cannot be found for the user,

The odd thing is that for one of the device groups this works, the others are configured identically but do not.

Any help greatly appreciated.

Quick edit, this is version 10.1.6

[Raido_Rattameister]

Do you get any error message when you try to switch context?

[laurence64]

Hi 

The error that we are getting is 

The firewall in question has no VSYS configured and is not in multi VSYS mode, the error does change if there is no role configured on the firewall at all to, predictably, No role for user, there is no difference in configuration between the one that works and the ones that do not, I have also made sure that the contexts are all enabled in the access domain config.

[Raido_Rattameister]

You created admin role under "Panorama > Admin Roles" and assigned to user but did not create role with matching name under "Device > Admin Roles" in firewall config?

[laurence64]

The other way around, so the role for admin users was created on Panorama, this was applied to the users as well as the access domain, the role that was defined in that admin role for context switch does exist with the same name on the firewalls we are context switching to.

Does the admin role that is defined for the users on panorama by defined in the context switch and then be present on the firewall as well ?