Hi.
i have passive authentication which is running the network.
Firepower works through Active Directory server and User Agent.
Normally, user policy is normal through user information of AD server.
I have downloaded only one of several groups of AD servers and are using it for user policy.
If AD server adds a new user to a user group, the user policy is normally applied.
However, if you exclude a user from a user group on the AD server and then add it again, the user policy not be applied.
In this state, if i download user from firepower, i see that you download the correct user, but user policy does not apply.
(The user is displayed correctly in the user item of the access-list, the login event is displayed in the user activity, and the id and ip are correctly mapped in the active session.)
but, If remove the AD server configuration from firepower and re-insert it, the user policy will be applied.
Or wait about 3 hours and the user policy will be applied.
Has anyone ever seen this issue?
Is there any way to make a change of user group on the AD server take effect immediately in firepower?
What is the logic to get the Group Policy from firepower?
Thanks.
