topic Re: Unable to download groups via AD/REALM with spaces and underscores in Network Security

Unable to download groups via AD/REALM with spaces and underscores

Heino Human — Tue, 26 May 2020 23:46:49 GMT

Morning legends,

So yesterday I finally got AD integrated with our new FMC. I was able to download groups and users, though noticed very quickly that any groups with spaces or underscores were not downloaded. I tried numerous times, though the problem remains.

Has anyone come across this and know of a solution?

I don't want to get our systems team to recreate the groups as they use resource manager and this will cause issues long term.

Thank you and have an amazing day!

Heino

Re: Unable to download groups via AD/REALM with spaces and underscores

Francesco Molino — Wed, 27 May 2020 04:05:42 GMT

Hi

Special characters aren’t supported but space and underscore aren’t part of that list.
I’m able to see all groups with spaces and/or underscores on my FMC.
What FMC version are you running?
Can you give an example of the group name not being downloaded?

How much groups have been downloded?

Re: Unable to download groups via AD/REALM with spaces and underscores

Heino Human — Wed, 27 May 2020 04:15:18 GMT

Hi Francesco,

We running 6.6 on a 4600 appliance and have downloaded just over 60K users and groups combined. Only the ones with spaces and underscores are missing.

Here are some samples:

imts desktop admins
rms_web_admins
ext_uc_app_engineer
restricted_network_access_vlan36_app_users
b&g security

Thank you

Re: Unable to download groups via AD/REALM with spaces and underscores

Heino Human — Mon, 22 Jun 2020 02:55:12 GMT

For anyone who else might have the same issue with 6.6 we had three issues in our environment which caused FMC not to download all the users and groups.

1. Make sure you spell and add the full correct DNS entry for your domain controllers. (this is a no brainer, but for some reason I made a stuff up with one of them....)

2. When setting the base and group DN, set it to the top of the tree, meaning, keep it like DC=CISCO,DC=COM. We had ours set to OU=USERS,DC=CISCO,DC=COM. This caused some service and other types of accounts not to be picked up as they not in the "USERS' OU.

3. After changing it to the above, we still had a few missing. We then changed the settings to capital letters and it worked.... no idea why it would not work on lower case.... weird one.

Laters and hope it helps someone else too.