ASA Firepower ignore users groups in Access Control Policy

[tank28m45]

Hello,

   We use ASA 5516-X with FirePower Services.

FirePower services version - 6.2.0 with 6.2.0.1-10 patch installed.

ASDM - 7.7.1

ASA  - 9.7.1

We use passive authentication with active authentication like fallback with Active Directory realm.

FirePower successfully download users and groups from Active Directory.  Foresight agent for Active Directory v 2.3-10 installed and work properly.

All users successfully authenticated. 

But: If we create access rule with Active Directory group it work some time. ~30 min.And that simple ignore users membership.

If I re-download users and group from Active Directory in realm config, it again work some time.

If we create access rule with Active Directory users directly it work always.

Need help.

P.S.

Domain NETBIOS name differ than name like domain.com

[Hugo Caye]

Hi there,

I have exactly the same problem, ASA-5515X and ASA-5506X.

FirePOWER v6.1.x did not have this malfunction.

It seems that if in the "User Download" tab the "Repeat Every" is changed to e.g. 12 or 24 h, it takes more time to ignore the group membership. Looking at the syslog messages and comparing with previous FP versions no LDAP related entries can be found in the FPT v6.2.

Realms recreatedm old ones deleted, same misbehaviour.

Also need help.

TIA

[tank28m45]

Hi,

Confirm. 

With the same config  6.1.0.2 version work properly.

I think this is 6.2.0.1 version bug.

[Hugo Caye]

Hi there,

Please look at this: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb69906

It seems that this bug was corrected, "Status: Fixed", Feb/27.

Do you know if there is a patch available or do we have to wait for a new FirePOWER code version?

Regards,

[tank28m45]

Hello,

Yes.  I have trouble exactly like  CSCvb69906.

This is not fixed in 6.2.0 and 6.2.0.1

[Hugo Caye]

Hi there,


I openned a TAC case and after some weeks the engineer accessed our FP, edited a file and this solved the problem. It was last week and since now we did not see the problem again.


He told that this fix will be included in a new v6.2 build to be released in the first days in May.


I did the same procedure in other two FP modules and it worked.


Regards,

Hugo

[tank28m45]

Hello,

Can You provide what do You do?

Regards,

Pavel.

[Hugo Caye]

Pavel, I think that I'm not authorized to publish here what he did.

Can you please search at Google by "hugo caye micmac" and send an email message to me?

Tks,

[Jose Carlos Sm de Lima]

Hi Hugo, how are you?

Please, can you share it with me? I send an e-mail to you.

Cya.