07-30-2019 12:08 PM
A securit policy is not getting used because ad group i entered is not matching the policy. On checking the cli i cannot list users in the ad group and get invalid syntax error.
show user group name cn=r-emp-it imp adm,ou=role restricted,ou=groups,ou=it ops,dc=cds,dc=abc,dc=com
Invalid syntax.
07-30-2019 01:14 PM
You should be able to test that group properly if you inclose it in quotes.
show user group name 'cn=r-emp-it imp adm,ou=role restricted,ou=groups,ou=it ops,dc=cds,dc=abc,dc=com'
07-30-2019 03:02 PM
@BPry that doesn't result in anything. I have other groups configured for which i can see the results but not for this one.
show user group name 'cn=i-r-em-all,ou=groups,ou=it,dc=cds,dc=abc,dc=com'
[1 ] cds\aar....
[2 ] cds\akas....
[3 ] cds\ala....
There is however another group which i know works in policies but that also is not showing results in cli and has a single space.
07-30-2019 03:38 PM
To be more clear from my earlier response, enclosing any entry that has a space in the name is how you get around the syntax issue you were getting before. This includes what we were doing here, but also when viewing/modify/setting any other entry with a space such as the name of a security rulebase entry.
I have no idea if double spaces will break the firewall's ability to actually grab group membership; I would expect it to handle that perfectly fine, but spaces are known to muck things up across AD integration so I always avoid using them in the actual CN. It would be interesting to look at the XML configuration and verify that the <member> entry under <source-user> for this particular policy was actually propagating properly, or if double spaces is screwing up the rule creation through the GUI. You could alternatively utilize the CLI command show rulebase security rules <entry> and see if it's getting cutoff or not.
07-31-2019 01:41 AM
to confirm....
show user group name 'cn=non remote helpers,ou=workstation,ou=restricted groups,ou=groups,dc=xxxx,dc=xxxx,dc=uk'
does return the expected list of users from AD.
we do have quite a few groups with multiple spaces and all work fine.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
