This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About Vimz888
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Vimz888
04-08-2022
10Posts
1Like
1Solution
Apr 08, 2022Last Visited
User
Activity
User
Profile
Latest posts by Vimz888
| Subject | Views | Posted |
|---|---|---|
| 1248 | 04-04-2022 09:54 AM | |
| 1270 | 04-04-2022 06:17 AM | |
| 1307 | 03-31-2022 01:29 PM | |
| 1390 | 03-31-2022 12:20 PM | |
| 1629 | 11-30-2021 12:53 PM | |
| 1716 | 11-29-2021 02:10 PM | |
| 2343 | 03-29-2021 07:28 AM | |
| 2390 | 03-28-2021 02:44 PM | |
| 3304 | 03-28-2021 01:20 PM | |
| 2447 | 03-28-2021 10:34 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 11-30-2021 12:53 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like |
User Badges
Community Statistics
| Member Since | 03-28-2021 10:09 AM |
| Date Last Visited | 04-08-2022 07:45 AM |
| Posts | 10 |
| Total Likes Received | 1 |
04-04-2022
09:54 AM
After further looking into this: >less mp-log authd.log 2022-04-04 16:34:52.266 +0100 debug: _get_auth_prof_detail(pan_auth_util.c:1099): non-admin user thru Global Protect "GPuser" ; auth profile "AUTHPROFILE" ; vsys "vsys1" 2022-04-04 16:34:52.266 +0100 debug: _get_authseq_profile(pan_auth_util.c:886): Auth profile/vsys (AUTHPROFILE/vsys1) is NOT auth sequence 2022-04-04 16:34:52.266 +0100 debug: _retrieve_svr_ids(pan_auth_service.c:645): could not find auth server id vector for AUTHPROFILE-vsys1-mfa 2022-04-04 16:34:52.266 +0100 debug: add_info_from_auth_profile_to_request(pan_auth_util.c:1055): MFA is not configured for the auth profile. No mfa server ids for the user "" (prof/vsys: AU THPROFILE/vsys1) 2022-04-04 16:34:52.266 +0100 debug: add_info_from_auth_profile_to_request(pan_auth_util.c:1066): MFA configured, but bypassed for GP user ''. (prof/vsys: AUTHPROFILE/vsys1) uest->username 2022-04-04 16:34:52.268 +0100 debug: pan_auth_cache_user_is_allowed(pan_auth_cache_allowlist_n_grp.c:569): This is a single vsys platform, group check for allow list is performed on "vsys1" 2022-04-04 16:34:52.271 +0100 debug: _authenticate_by_localdb_or_remote_server(pan_auth_state_engine.c:1835): Authenticating user "GPuser" with <profile: "AUTHPROFILE", vsys: "vsys1"> 2022-04-04 16:34:52.271 +0100 debug: _retrieve_svr_ids(pan_auth_service.c:648): find auth server id vector for AUTHPROFILE-vsys1 2022-04-04 16:34:52.273 +0100 debug: pan_authd_ldap_authenticate(pan_authd_shared_ldap.c:1132): searching basedn "DC=paloeveng, DC=local" for filter "(uid=GPuser)", attrs "framedIPAddress", LDAPp=0x559d6c17c670 2022-04-04 16:34:52.338 +0100 Error: pan_authd_ldap_authenticate(pan_authd_shared_ldap.c:1193): Received empty DN for user "GPuser". Try to re-establish the connection 2022-04-04 16:34:52.338 +0100 debug: pan_authd_ldap_authenticate(pan_authd_shared_ldap.c:1328): binding back to binddn: paservice@paloeveng.local (Try 1) 2022-04-04 16:34:52.338 +0100 debug: pan_authd_ldap_bind(pan_authd_shared_ldap.c:637): binding with binddn paservice@paloeveng.local 2022-04-04 16:34:52.358 +0100 Error: _start_sync_auth(pan_auth_service_handle.c:749): sync request for user "GPuser" is failed or possibly timed out against 192.168.150.10:389 with 0th VOID p=0x559d6c17c670 gine.c:4322): auth status: auth state unknown Strolled through the basedn on AD, which was correct After looking into it further via https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClpoCAC There was a misconfiguration on the LDAP profile, which caused the issue. Changed the following The "Type" was set to "other" instead of "active-directory" Thank you and I hope this helps anyone having the same issue.
... View more
04-04-2022
06:17 AM
Hi, Thank you for your response. I tried using another instance of the browser (chrome), but had the same issue. It logged me out straight away. - just for clarity, I was using :4443 for the GUI portal and :443 for GP. Used a completely different browser (Edge), AND that did RESOLVE the issue - my question is why would it sign you out on the same browser, it's using different ports. ==== With regard to the authentication locally, that is working fine. I am able to log into GP with the un/pw set locally. name VPN1 passwordE1> test authentication authentication-profile AUTH-Local user Enter password : Target vsys is not specified, user "VPN1" is assumed to be configured with a shared auth profile. Do allow list check before sending out authentication request... name "VPN1" is in group "all" Authentication by Local User Database for user "VPN1" Authentication succeeded for Local User Database user "VPN1" == I tested the authentication of the UN/PW and this is the output I get, AD is connected, I can authenticate the username/password on the machine that are connected to the domain. It is only GP that does not want to work. rname GPuser password test authentication authentication-profile AUTHPROFILE use Enter password : Target vsys is not specified, user "GPuser" is assumed to be configured with a shared auth profile. Do allow list check before sending out authentication request... user "paloeveng.local\GPuser" is a member of allowed group "cn=paloalto,ou=firewall,dc=paloeveng,dc=local" on vsys "vsys1" Authentication to LDAP server at 192.168.150.10 for user "GPuser" Egress: 192.168.22.10 Type of authentication: plaintext Starting LDAP connection... Succeeded to create a session with LDAP server Received empty DN for user "GPuser" Authentication failed against LDAP server at 192.168.150.10:389 for user "GPuser" Authentication failed for user "GPuser" Not sure what this is indicating Received empty DN for user "GPuser" Thanks,
... View more
03-31-2022
12:20 PM
Hi, I currently have Palo running within a EVENG environment. I have set up Global Protect, the problem seems to be every time I try to log into GP using an AD account. I am automatically logged out of the Palo GUI. Furthermore, the username/password does not even authenticate, even though the un/pw is correct, Has anyone had this problem ? Thank you in advance.
... View more
11-30-2021
12:53 PM
1 Kudo
Hi, The authentication is against the below: a user called "gpuser" is part of this When I try to authenticate the user "gpuser" against AD, i get the following message: -SITE1> test authentication authentication-profile AUTHPROFILE username gpuser password Enter password : Target vsys is not specified, user "gpuser" is assumed to be configured with a shared auth profile. Do allow list check before sending out authentication request... user "paloeveng.local\gpuser" is a member of allowed group "cn=paloalto,ou=firewall,dc=paloeveng,dc=local" on vsys "vsys1" Authentication to LDAP server at 192.168.150.10 for user "gpuser" Egress: 192.168.22.10 Type of authentication: plaintext Starting LDAP connection... Succeeded to create a session with LDAP server Received empty DN for user "gpuser" Authentication failed against LDAP server at 192.168.150.10:389 for user "gpuser" Authentication failed for user "gpuser" - I am not sure what this bit means "Received empty DN for user "gpuser"" If you need anymore info, let me know. Thanks.
... View more
11-29-2021
02:10 PM
Hi, I have a test AD/PA setup. AD and LDAP connectivity is okay so far. My problem is that I am unable to authenticate any user against Global Protect. The un/pw are correct. The group are correct too, as far as I can see. This is the output i get when trying to authenticate: SITE1> test authentication authentication-profile AUTHPROFILE username paloeveng.local\gpuser password Enter password : Target vsys is not specified, user "paloeveng.local\gpuser" is assumed to be configured with a shared auth profile. Do allow list check before sending out authentication request... user "paloeveng.local\gpuser" is a member of allowed group "cn=paloalto,ou=firewall,dc=paloeveng,dc=local" on vsys "vsys1" Authentication to LDAP server at 192.168.150.10 for user "paloeveng.local\gpuser" Egress: 192.168.22.10 Type of authentication: plaintext Starting LDAP connection... Succeeded to create a session with LDAP server Received empty DN for user "gpuser" Authentication failed against LDAP server at 192.168.150.10:389 for user "paloeveng.local\gpuser" Authentication failed for user "paloeveng.local\gpuser" =========== SITE1> show user group name "cn=paloalto,ou=firewall,dc=paloeveng,dc=local" short name: paloeveng.local\paloalto source type: ldap source: Paloeveng-profile [1 ] paloeveng.local\gpuser =========== What am i missing within the config? Thank you in advance.
... View more
03-29-2021
07:28 AM
Probing is enabled, Interval is set as default of 20min. "also check your 'cache' as the default is 45 minutes which is too short in most cases (go for 9 hours which corresponds to the average kerberos ticket/time spent at work)" I increased "Cache" User ID Timeout to 540min, Commited… Soon after committing, I got CONNECTIVITY.... traffic is being allowed. Thank you very much for your help and guidance.
... View more
03-28-2021
02:44 PM
Many thanks for replying, Under "Group Mapping", I have set it "palo" instead of "palo.local" Within AD, I have a OU called "Firewall" - Within the Firewall OU > I have a Security Group called "paloalto" - I have two test account Members within "paloalto" - dmzuser - trustuser - The "paloalto" is attached to the Source User within the Policy. - Now, I am using 1 of those test account (dmzuser) to test the connectivity (from Winz7) but cannot access the internet. Here is what I am finding, I keep on seeing "Unknown" admin@PA-VM> show user ip-user-mapping all IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------------------------------------- ------------------- ------- -------------------------------- -------------- ------------- 192.168.40.3 vsys1 AD palo\dmzuser 770 770 <<<<<<<< even though its listed I am unable to reach the internet. 192.168.20.1 vsys1 AD palo\pauser 2655 2655 192.168.20.3 vsys1 Unknown unknown 1 4 Total: 3 users ======================= The host would just disappear:- 192.168.40.3 is the host where i am testing the connectivity from admin@PA-VM> show user ip-user-mapping all IP Vsys From User IdleTimeout(s) MaxTimeout(s) --------------------------------------------- ------------------- ------- -------------------------------- -------------- ------------- 192.168.20.1 vsys1 AD palo\pauser 2688 2688 Total: 1 users There is no connectivity issue between the hosts/PA and AD When i do Tracerotue from the test machine (192.168.40.3), I just get Request Timed Out... - this is only when I have OU "paloalto" attached as Source. Thank you
... View more
03-28-2021
10:34 AM
Hi Everyone, I am currently having issues trying to get UID to work on Eve-NG using PANOS 9.0.4, it is a only a EVAL license but everything is working except for UID. I have followed agentless guide to setup and AD server is connected to the PA as per the "User Mapping" tab. Policy is setup correctly, however as soon as I add "Domain Users" as the Source to the policy and commit, the host loses connectivity to the internet.. - Now, if I was to leave the Users blank then the host is able to get the internet. Currently, seeing the below error, but been unable to find any resolution. 2021-03-27 21:41:10.163 +0000 Warning: pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1279): For palo\pauser user, domain palo does not exist in group-mapping 2021-03-27 21:41:13.157 +0000 Warning: pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1279): For palo\pauser user, domain palo does not exist in group-mapping 2021-03-27 21:41:16.149 +0000 Warning: pan_user_group_user_prime_uid_lookup(pan_user_group_multi_attr.c:1279): For palo\pauser user, domain palo does not exist in group-mapping domain palo does not exist in group-mapping - It is mapped correctly (so, i think) and I am able to pull the directory directly from AD. ====== This is the Group Mapping: Group Mapping(vsys1, type: active-directory): GroupPro Bind DN : pauser@palo.local Base : DC=palo, DC=local Group Filter: (None) User Filter: (None) Servers : configured 1 servers ADserver2016.palo.local(389) Last Action Time: 1020 secs ago(took 0 secs) Next Action Time: In 2580 secs Number of Groups: 2 cn=paloalto,ou=firewall,dc=palo,dc=local cn=domain users,cn=users,dc=palo,dc=local Please let me know if you need more information. Thank you in advance.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
04-08-2022
07:45 AM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks