topic Re: Cisco FMC LDAP users and group synchronisation problem. in Network Security

Cisco FMC LDAP users and group synchronisation problem.

it-infrastructure-team — Tue, 25 Mar 2025 14:44:49 GMT

Hi colleagues,
I've encountered the following situation - the system shows the following warning messages for rules in ACpolicy:

Our scheme in general.
We have an FMCv is deployed in the DC, which controls 2 FTD devices (FPR 3140).
An Identity Policy and an Access Control Policy are configured for every FTD devices

The Access Control Policy relies not only on Source and Destination IPs, but also on the User Group for which the rule is to be used.

In other words, we use 2 different Realms, each with its own Groups and Users.
However, we do not use all Groups and Users for verification, but only the necessary ones.

What could be the problem and how can it be solved ?
Maybe someone has encountered it ?

Re: Cisco FMC LDAP users and group synchronisation problem.

Marvin Rhoads — Tue, 25 Mar 2025 15:27:50 GMT

Have you included the groups in question in your realm synchronization settings?

Re: Cisco FMC LDAP users and group synchronisation problem.

it-infrastructure-team — Tue, 25 Mar 2025 16:15:31 GMT

Hi @Marvin Rhoads
Yes, I have added only specific Groups and Users for every Realm only to “Included Groups and Users” and have not added any groups or Users to “Excluded Groups and Users”.

Re: Cisco FMC LDAP users and group synchronisation problem.

it-infrastructure-team — Tue, 25 Mar 2025 16:20:35 GMT

And currently I've trying to troubleshoot the Users and Goups synchronisation by this Cisco guide:
https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2590.pdf
I was found that the file /var/sf/user_enforcement/ugm_snapshot.0 contains the Groups which we previoulsy excluded from the synchronisation. And the file not holds the Groups which we realy using...
Seems strange ...

Re: Cisco FMC LDAP users and group synchronisation problem.

Marvin Rhoads — Wed, 26 Mar 2025 16:54:10 GMT

Since you appeared to have done all the basic configuration bits properly, it may be you are hitting a bug.

Short of opening a TAC case, the only other thing I might try would be to remove and re-add the realm integration/

Re: Cisco FMC LDAP users and group synchronisation problem.

it-infrastructure-team — Thu, 27 Mar 2025 14:10:49 GMT

@Marvin Rhoads
Maybe you how to get a list of Groups and Users from FMC and FTD by API ?
Perhaps it helps me to more clearly uderstand my situation.