Access Domains and context switching

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Access Domains and context switching

L4 Transporter

HI All,

 

 

I have configured access domains to control read only access to certain device groups, but the context switching is not working, I have configured a Admin Role locally, added the user to the local device with an admin role, even added the username as the device and vsys role to see if that would work, the log output from #tail follow yes mp-log authd.log shows that the user logs in and that role cannot be found for the user,

The odd thing is that for one of the device groups this works, the others are configured identically but do not.

Any help greatly appreciated.

Quick edit, this is version 10.1.6

PCCSA PCNSA PCNSE PCSAE
1 accepted solution

Accepted Solutions

Hi All,

 

After a call with TAC it has been discovered that this is in fact another bug in 10.1, fixed in 10.1.7 and above and tracked under 

PAN-189206 the bug prevents the context switching for any user other than a Panorama superuser, this also affects 10.2 early releases but I believe is fixed in later releases as well, the link to the release notes is below 
 

 

PCCSA PCNSA PCNSE PCSAE

View solution in original post

9 REPLIES 9

Cyber Elite
Cyber Elite

Do you get any error message when you try to switch context?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi 

 

The error that we are getting is 

laurence64_0-1671528396847.png

The firewall in question has no VSYS configured and is not in multi VSYS mode, the error does change if there is no role configured on the firewall at all to, predictably, No role for user, there is no difference in configuration between the one that works and the ones that do not, I have also made sure that the contexts are all enabled in the access domain config.

PCCSA PCNSA PCNSE PCSAE

Cyber Elite
Cyber Elite

You created admin role under "Panorama > Admin Roles" and assigned to user but did not create role with matching name under "Device > Admin Roles" in firewall config?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

The other way around, so the role for admin users was created on Panorama, this was applied to the users as well as the access domain, the role that was defined in that admin role for context switch does exist with the same name on the firewalls we are context switching to.

Does the admin role that is defined for the users on panorama by defined in the context switch and then be present on the firewall as well ?

PCCSA PCNSA PCNSE PCSAE

Cyber Elite
Cyber Elite

Create role under "Panorama > Admin Roles" for Panorama and under "Device > Admin Roles" for firewall and try then.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Hi

 

That hasn't solved it unfortunately, I have still got the Vsys error, this isn't a bug 10.1.6 is it ?

PCCSA PCNSA PCNSE PCSAE

Cyber Elite
Cyber Elite

Do you mind to share screenshot of settings at "Panorama > Admin Roles" and "Device > Admin Roles"?

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

Unfortunately I would have to redact it so much that it wouldn't be much use, just a quick question, when you say device > admin roles are you referring to the device templates stored on Panorama or locally on the firewall ?

 

PCCSA PCNSA PCNSE PCSAE

Hi All,

 

After a call with TAC it has been discovered that this is in fact another bug in 10.1, fixed in 10.1.7 and above and tracked under 

PAN-189206 the bug prevents the context switching for any user other than a Panorama superuser, this also affects 10.2 early releases but I believe is fixed in later releases as well, the link to the release notes is below 
 

 

PCCSA PCNSA PCNSE PCSAE
  • 1 accepted solution
  • 2335 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!