topic Re: Recursive group membership not working for Office Mode in SASE and Remote Access

Recursive group membership not working for Office Mode

David_Herselman — Wed, 12 Sep 2018 20:49:11 GMT

We defined an LDAP group referencing our AD:

Name: AD_vpn_access

Account Unit: ad.lair.co.za__AD

Group's scope: Only group in branch (DN prefix)

Prefix: CN=vpn_access,OU=Firewall,OU=Security Groups,OU=Syrex

We then link this through to the Mobile Access Office Mode settings:

Nested LDAP groups work perfectly for security policy firewall rules but VPN access is not granted unless members are direct members of the vpn_access AD security group.

Is this a bug, known limitation or is there a setting I should be changing somewhere?

Re: Recursive group membership not working for Office Mode

PhoneBoy — Wed, 12 Sep 2018 22:40:42 GMT

Operating as designed per the following sk: Mobile Access and Endpoint clients LDAP nested groups are not enforced correctly

Re: Recursive group membership not working for Office Mode

David_Herselman — Thu, 13 Sep 2018 10:21:00 GMT

Hi Dameon,

Would you possibly know where we can go to have this logged as a feature request? The internal components to recursively resolve nested LDAP group memberships is in the code base already...

Re: Recursive group membership not working for Office Mode

G_W_Albrecht — Thu, 13 Sep 2018 10:58:55 GMT

Here you go:http://www.checkpoint.com/rfe/rfe.htm