topic Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work in Network Security

FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Fri, 13 Nov 2020 00:32:28 GMT

Hi all,

we have setup up a AD realm and a identity police. We want to apply ACLs to allow RA VPN connections for some users to some destinations.

The AD realm connection is working according to the test function. When we create an ACL, switch to user tab, the AD realm connection doesn't show the user and groups of the AD.

The AnyConnect is working, logon with AD credentials of a user is working fine.

Is there something special to do to get the users and groups from AD realm?

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Mohammed al Baqari — Fri, 13 Nov 2020 02:33:49 GMT

Hi,

After adding the real and importing users/groups, you need to hit on
download users/groups. Only after that you will see them in ACP > User tab.

**** please remember to rate useful posts

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Fri, 13 Nov 2020 10:08:35 GMT

The Firepower is managed in FDM, is there an option to download? I haven't found anything like that before.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Aref Alsouqi — Sat, 14 Nov 2020 18:19:52 GMT

How did you configure your identity policy?

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Sat, 14 Nov 2020 20:43:43 GMT

I have tried various variants. The last one I tried was:

RAVPN_Hosts-192.168.10.0 is the network assigned to VPN clients. Inside_Network-192.168.0.0 is the default internal network.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Aref Alsouqi — Mon, 16 Nov 2020 06:42:25 GMT

I think you won't see the users/groups till you deploy the changes, did you deploy the changes and still don't see them? Regarding the identity policy you created, it looks good to me. The FTD will use AnyConnect to get the users identity and create the user to IP mapping. Once that is created, the FTD can then enforce the security rules you configured for those users.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Leon1 — Wed, 25 Nov 2020 09:29:01 GMT

Hello!

I have a similar problem with this Version.

Since upgrade to 6.7 group changes are no longer synchronized. I can change the users group in active directory but it is not reflected in the FTD Device (ASA 5508-X with FTD 6.7 and FDM - no FMC). This results of not applied ACLs.

- I have created new users and they are able to login, but their AD groups are completely ignored.

- When I change the group memberships of an older user, it is also not reflected and the ACLs are not applied.

- If I create a new group in the active directory, I cannot find it in the ACL dialoge. Even if I wait 24h for a automatically sync.

tried to remove and add the realm again to force a new sync. Applied a deployment and reboted the device.

...but nothing helps.

New employees are actually not able to work in home office, because of this. I need a fix asap.

What can I do? Any suggestions?

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Leon1 — Mon, 30 Nov 2020 13:02:57 GMT

Has anybody created a bug with Cisco and may provide the Bug ID? This way we can vote for it.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Mon, 30 Nov 2020 14:25:03 GMT

I have an open case since 27th of November. I hope the engineer will have a solution as soon as possible. I don't have a bug ID yet.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Thu, 03 Dec 2020 22:42:51 GMT

Until today Cisco engineers were not able to fix the issue nor treated it as a bug.

Today we did some debugging in CLI with debug ldap 255. There are not errors, connection to Active Directory is fine.

It's very annoying that it takes weeks to get a solution, the assigned engineer changed almost every day because no response happened or was not available.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Leon1 — Fri, 04 Dec 2020 08:50:38 GMT

This is annoying. Yesterday I forwarded this bug to our service partner to help creating a bug in Ciscos bug tracker. I will keep you posted.

You started with 6.7.0?

I made an upgrade from 6.6 and until then it was working well. I have not changed anything, just updated to 6.7 and it stopped working. There is a bug, definitely!

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Fri, 04 Dec 2020 13:49:46 GMT

I started with 6.7., we did not use the Firepower before because of missing features.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Tue, 08 Dec 2020 23:40:12 GMT

I have received feedback from Cisco engineer today:

I have recreated the issue on our lab and also, I was able to apply a simple workaround and download the users and groups on the ACP rule, users tab

We also have defect for this behavior, which is tracked under CSCvu67638, is it not customer visible yet but we are working on that.

Workaround:
Make a small change on the realm configuration this will trigger a new user and group data download as part of the deployment.

Unfortunately the workaround doesn't work here.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Leon1 — Wed, 09 Dec 2020 09:23:29 GMT

Amazing! A step in the direction of a solution.

I got a similar response to restart the component. Maybe this helps as a workaround in your situation?

admin@host$ sudo su

root@host$ pmtool disablebyid adi

root@host$ pmtool enablebyid adi

But I already restarted the whole device and tried the change the realm config to force a resync. Nothing helped. I have no idea whey they had success with their "workaround".

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Wed, 09 Dec 2020 12:30:08 GMT

For me this workaround didn't work too. I am curious how long it will take to get a fixed update.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

mcgiga — Wed, 09 Dec 2020 15:32:29 GMT

I had another WebEx call with the engineer in this support case some minutes ago. He had a look at the realm configuration, everything was fine expet the username of AD he said.

We changed it from samAccountName (i.e. cisco.user) to userPrincipalName (i.e. cisco.user@domain.tld). After deploying it, what should I say, it's working and pulling groups and user accounts.

It's very strange because in the last two weeks I have changed so many things in realm configuration (FQDN instead of IP address, different useraccounts etc.) and of course the samAccountName to UserPrincipalName and it didn't worked!

Maybe it has something to do with your workaround (pmtool disablebyid adi, pmtool enablebyid adi) which I tried today.

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Leon1 — Wed, 09 Dec 2020 15:37:29 GMT

ouh... I am running the realm Config since two years now and I have just updated. Maybe the function has been changed in 6.7.0. I will try it out this evening and let you know.

Crazy...

Re: FTD 1010 / 6.7: Connection to AD realm and ACL/identity policy doesn't seem to work

Leon1 — Wed, 09 Dec 2020 16:02:36 GMT

Okay I can confirm this is working now!

It seems there is a change in the way the username is used for authentication. I have added the the domain suffix "@bla.bla" and executed the commands I sent to you and now it is working. I can see the groups I have created for testing now in the ACL settings.

Thank you! The Cisco community is awesome!

You can give me a "helpful" rating for the issued commands if you like 😉

Have a nice day