topic Identity FW - ACL with AD Group not matching in Network Security

Identity FW - ACL with AD Group not matching

Igor Rodriguez — Tue, 12 Mar 2019 02:17:24 GMT

Hello all,

I have set up our Cisco ASA 8.4(4)1 so that it works as an Identity Firewall. Everything is going fine, except the following:

I've made an ACL so that only allowed users access a few FTP servers. The thing is that those users belong to an Active Directory group. Using the AD group, the ACL is not being matched and therefore, is not working.

However, if I change that AD group and try only my AD user, it does work.

I have other ACLs matching AD groups and are working fine.

So my question is:

Is there any limitation to those AD groups?

What can I check to know why my user (that belongs to that AD group) is not being allowed while ACL includes AD group?

Any help will be appreciated.

Thanks in advance.

Best regards,

Igor

Identity FW - ACL with AD Group not matching

Igor Rodriguez — Mon, 29 Jul 2013 08:09:54 GMT

Any idea of how could I try to solve this?

Thanks.

Identity FW - ACL with AD Group not matching

Igor Rodriguez — Fri, 02 Aug 2013 08:44:31 GMT

I've made another test. I've changed the group that matches the ACL and it works.

The differences between groups are:

- They're located in different OUs, but both are accessible.

- One has 6 users and the other many more.

Is there any kind of restriction on how many users a group can contain so that ASA is able to check it?

Other group that does not work is a group (Global_FTP) containing 3 different groups, being one of them that other group (FTP_OfficeXX).

Any help will be appreciated.

Thanks!!!

Identity FW - ACL with AD Group not matching

Igor Rodriguez — Mon, 30 Sep 2013 15:12:03 GMT

Hello again everybody,

I was wondering if maybe because of summer vacations this post was missing to some of you.

Anyone has any idea of why ACL does not match when using an old and with more members group?

Thanks in advance.

Best regards,

Igor