I have two issues with managing firewall policies when using AD groups; running 4.1.7 - so am using the 'on-hardware' group retrieval rather than the PAN Agent. 1) When adding new groups to be mapped they do not appear in the GUI i.e. cannot be selected for a policy from the 'drop down' selector. This will usually fix itself after a random amount of time - hours or days (and this occurs even when, using the command line interface, I have confirmed that the group is being populated and tracked by the firewall using the show users groups name command etc). 2) The Palo policy UI seems to randomly display the groups (and users) in either AD format or X500(?) format i.e. sometimes it uses acme\auser and othertimes it uses cn=auser, ou=users, o=acme This occurs both on the PA firewalls and our Panorama install. It's annoying more than anything, as we can usually work our way round the issue, but understanding why it doesn't behave consistently would be a bonus! Rgds
... View more
