LDAP Authentication Fails When Using a User-ID Service Route

Issue

With the Service Route for User-ID Agent configured, as shown below, LDAP will not use the service route and still tries to connect

to the LDAP server on the management interface.

Cause

The Palo Alto Networks firewall does not support application-based service routes for LDAP-based authentication.

Note: Group mapping will use the configured service route to communicate with LDAP, however, as it is a part of User-ID.

Resolution

To use a service route for LDAP authentication, configure a destination based service route (Device > Setup > Service Route Configuration), as shown below:

If this destination based service route is not configured and the management interface is unable to connect to the LDAP server, the following error messages will appear in the authd.log file:

Oct 18 00:28:23 pan_authd_authenticate_service(pan_authd.c:686): authentication failed (6)

Oct 18 00:28:23 Authenticating user using service /etc/pam.d/pan_ldap_vsys1_ldap_0,username USERNAME failed - trying other hosts

Oct 18 00:28:23 pan_authd_common_authenticate(pan_authd.c:1672): Skipping LDAP server due to missing Auth-Profile: pan_ldap_vsys1_ldap_1

Oct 18 00:28:23 pan_authd_common_authenticate(pan_authd.c:1672): Skipping LDAP server due to missing Auth-Profile: pan_ldap_vsys1_ldap_2

Oct 18 00:28:23 pan_authd_common_authenticate(pan_authd.c:1672): Skipping LDAP server due to missing Auth-Profile: pan_ldap_vsys1_ldap_3

owner: rvanderveken