Cisco FMC LDAP users and group synchronisation problem.

[it-infrastructure-team]

Hi colleagues, 
I've encountered the following situation  -  the system shows the following warning messages for rules in ACpolicy:

Our scheme in general.
We have an FMCv is deployed in the DC, which controls 2 FTD devices (FPR 3140). 
An Identity Policy and an Access Control Policy are configured for every FTD devices

The Access Control Policy relies not only on Source and Destination IPs, but also on the User Group for which the rule is to be used.

In other words, we use 2 different Realms, each with its own Groups and Users. 
However, we do not use all Groups and Users for verification, but only the necessary ones.

What could be the problem and how can it be solved ?
Maybe someone has encountered it ?

[Marvin Rhoads]

Have you included the groups in question in your realm synchronization settings?

[it-infrastructure-team]

Hi @Marvin Rhoads 
Yes, I have added only specific Groups and Users for every Realm only to “Included Groups and Users” and have not added any groups or Users to “Excluded Groups and Users”.

[Marvin Rhoads]

Since you appeared to have done all the basic configuration bits properly, it may be you are hitting a bug.

Short of opening a TAC case, the only other thing I might try would be to remove and re-add the realm integration/

[it-infrastructure-team]

@Marvin Rhoads 
Maybe you how to get a list of Groups and Users from FMC and FTD by API ?
Perhaps it helps me to more clearly uderstand my situation.

[it-infrastructure-team]

And currently I've trying to troubleshoot the Users and Goups synchronisation by  this Cisco guide:
https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKSEC-2590.pdf
I was found that the file /var/sf/user_enforcement/ugm_snapshot.0 contains the Groups which we previoulsy excluded from the synchronisation. And the file not holds the Groups which we realy using... 
Seems strange ...