Palo Alto LDAP and User-ID

-

 


User ID:

AD user agent
LDAP user agent
captive portal
TS agent
PAN client













Configure LDAP

1. Create a service account called "ldap" in AD Managed Service Accounts OU.

2. Verify FW DNS is configured with internal AD/DNS server.

3. Verify Service route for DNS/LDAP points internal LAN.

4. Add a LDAP Server Profile and commit the change

















5. Verify LDAP connection is good.

     5.1 Can see Base DN show up, select it.

6. Add group mapping, commit the change.






























7. Verify Security policy can use username or groups.














Configure User-IP mapping

WinRM is recommenced.

1. Enable User-ID by zone









     2. Verify Kerberos service route points to internal and FW DNS is configured with internal AD/DNS server.

3. Create a Kerberos server profile

















  







   4. Configure agentless settings.
If use dedicated service account, refer:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-ip-addresses-to-users/create-a-dedicated-service-account-for-the-user-id-agent




     5. Add monitor server, commit the change
















6. Verify monitor server status is connected





check Logs > User-ID

check mapping from CLI

show user user-ids match-user []
show user ip-user-mapping all


  




show user user-ids match-user []
show user ip-user-mapping all


admin@PA440-2(active)> show user group-mapping state all

Group Mapping(vsys1, type: active-directory): LDAP-Group-Mapping
        Bind DN    : cn=ldap,cn=users,dc=sc,dc=local
        Base       : dc=sc,dc=local
        Group Filter: (None)
        User Filter: (None)
        Servers    : configured 1 servers
                10.0.0.10(389)
                        Last Action Time: 3130 secs ago(took 0 secs)
                        Next Action Time: In 470 secs
        Number of Groups: 4
        cn=contractors,cn=users,dc=sc,dc=local
        cn=employees,cn=users,dc=sc,dc=local
        cn=helpdesks,cn=users,dc=sc,dc=local
        cn=network admins,cn=users,dc=sc,dc=local


admin@PA440-2(active)> show user group name "cn=network admins,cn=users,dc=sc,dc=local"

User group 'cn=network admins,cn=users,dc=sc,dc=local' does not exist or does not have members
>

admin@PA440-2(active)> debug user-id refresh group-mapping all
group mapping 'LDAP-Group-Mapping' in vsys1 is marked for refresh.

admin@PA440-2(active)> show user group name "cn=employees,cn=users,dc=sc,dc=local"
short name:  sc\employees
source type: ldap
source:      LDAP-Group-Mapping
[1     ] sc\user1

https://knowledgebase.paloaltonetworks.com/kCSArticleDetail?id=kA10g000000PLey







Authentication Profile refers a server profile (with Allow List), then be used in creating admin account or  captive portal to actually authenticate user:


test authentication authentication-profile Auth-Profile username user1 password 

admin@Panorama> test authentication authentication-profile AuthProfielLDAP username user1 password
Enter password :
Target vsys is not specified, user "user1" is assumed to be configured with a shared auth profile.
Do allow list check before sending out authentication request...
name "user1" is in group "all"
Authentication to LDAP server at 172.16.1.10 for user "user1"
Egress: 172.16.1.62
Type of authentication: plaintext
Starting LDAP connection...
Succeeded to create a session with LDAP server
DN sent to LDAP server: CN=user1,CN=Users,DC=lab,DC=local
User expires in days: never
Authentication succeeded for user "user1"
admin@Panorama>


If use local user DB for admin access:
1. Create a local user and/or user group
2. Create a Authentication Profile, authentication type choose Local Database, configure Allow List.
3. Create an administrator identical name with step one, choose Authentication Profile created in step2. Assign Administrator Type Dynamic or Role Based. 
 
If use external DB like radius for admin access:
1. Create Server profile
2. Create Authentication Profile, authentication type choose the one created in spep1.
3. Device>Setup>Management>Authentication Settings, select Authentication Profile created in step 2.
4. Create an Admin Role Profile


Authentication Policy define what trigger the authentication.

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more