About OneAmongMany

  Hey All   While working a support case for a customer, I've come accross an odd situation and before I go log to Palo TAC I wondered if anyone else had seen this/was aware of it:   So Authentication profile configured with an allow list restricted for one LDAP group. I can use that Auth Policy in say GlobalProtect and sure enough- only users who are members of that group can connect to the portal.   > show user user-ids all -shows the list of users pulled in by User/Group mapping (so the firewall knows a user is in that group), but when I run;   > test authentication authentication-profile X username Y ...etc.etc. - this always fails ("User Y is not allowed with Authentication Profile X"), unless I include the specific username in the allow list in the Auth Profile, or I allow 'All'. With and without appending domain info - same result.   Looking at the documentation available - all examples of testing an Auth Profile using LDAP, matches the group 'All' (e.g https://www.paloaltonetworks.com/documentation/80/pan-os/cli-gsg/use-the-cli/test-the-configuration/test-the-authentication-configuration 😞   "Do allow list check before sending out authentication request... name "bzobrist" is in group "all" ..." (its never a restricted LDAP group)   I did see here : https://www.paloaltonetworks.com/documentation/80/pan-os/web-interface-help/device/device-authentication-profile/configure-an-authentication-profile   -that "Because you cannot configure the firewall to modify the domain/username string that a user enters during SAML logins, the login username must exactly match an Allow Listentry." I am seeing this behaviour with LDAP, both in the customer's environment and I have replicated it simply enough in our lab. Anyone restricted an Auth Profile to an LDAP group and then been able to run the '>test authentication...' cli command  and have it work?   Many Thanks   Alex ... View more

Hi All   I am seeing the following in the system log of a PA-200 on reboot:    critical hw             bootstr 0  No bootstrap media detected     I can't find any reference to this message anywhere and indeed all the errors that can be ebcountered while bootstraapping are all severity high, rather than critical: https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/bootstrap-the-vm-series-firewall/bootstrap-errors   I have never bootstrapped a device myself, so I don't know if that would have a lasting effect (like it will always check for bootstrap media and leave this message if it doesn't have any)?   There's nothing in the USB port, but the only other thing I can think is that the port is erroneously registering something being plugged in. I've not found any other log messages relating to this, just this one 4 times (each time its rebooted).    Thanks in advance for any help, anyone can offer.    Alex ... View more