Internet problems with work group users after LDAP integration

[onderoglu]

Hi,

I have 2 firewall rules, if the computer is in "open group", there is no problem, They are working with rule 94. But a computer that is not in the group cannot use rule 95. If I disable rule 94, everyone is working.

I don't have this problem with my other firewalls.

Thank you

1)

edit 94
set srcintf "CLIENT"
set dstintf "virtual-wan-link"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set ssl-ssh-profile "no-inspection2"
set logtraffic all
set nat enable
set groups "Open Group"
next
end

2)

edit 95
set srcintf "CLIENT"
set dstintf "virtual-wan-link"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set utm-status enable
set ssl-ssh-profile "certificate-inspection"
set av-profile "default"
set webfilter-profile "default"
set ips-sensor "default"
set application-list "default"
set logtraffic all
set nat enable

[johnjust67]

Looks like a group membership or rule conflict issue. Sometimes a small overlooked setting causes all the trouble like finding a hidden item on a Secret Menu that changes everything.

[AEK]

Hi Onder

Use the following cli commands the reproduce the issue to see what is happening.

diag debug flow filter addr x.x.x.x
diag debug console timestamp enable
diag debug flow show iprope enable
diag debug flow show function-name enable
diag debug flow trace start 100
diag debug enable

 Where x.x.x.x is the IP of a user that is not in the Open Group.

[onderoglu]

Thank you for your support, I cant to copy text file.

[AEK · Accepted solution]

According to the logs:

1. The traffic seems matched by policy 94 (even if it is not in Open Group)
2. Then followed by: func=__iprope_user_identity_check line=x msg="ret-stop"
3. Then denied

This is probably due to authentication settings. You need CLI to check and fix it.

In "config user setting" you have probably set "auth-on-demand" to always.

Try set it to the default value "implicitly" and see if it helps.

[onderoglu]

you are perfect, 

config user setting

set auth-on-demand implicitly

thank you very much...