New groups created in AD not showing up in fortigate

[clarkg]

I have 2 3600c' s in an active-active setup with firmware v5.0,build6216 (GA), and am also using vdom' s. I have noticed recently that when I create new groups in AD (global security groups or universal security groups) they are not showing up in my User & Device/User/ User Group/available members, under my fortinet single sign on. I have attached a pic of where I am talking about. I have a ticket with support open for this, but was just curious if anyone has seen an issue like this before and how you fixed it. We rebooted both fortigates this weekend, because we were testing a new backup generator. I have also rebooted the FSSO agent, and the server that it is on, to no avail.

[clarkg]

Can you do a: diag deb auth fsso list-users and have a look if the group shows up there with a user, that belongs to the group? I also remember once having had troubles with group names or DNs that were too long in total... They just didn' t show up correctly - maybe this info can also help you ... br, Roman

I don' t think it' s the length, cause I have groups in there that are much longer.

[romanr]

It is recommended to use the group filter in the FSSO agent to only make those groups visible to the Fortigate, which are being used to in the firewall! Otherwise you send a lot more information to the firewall, than it needs - which may result in perfomance loss! br, Roman

[romanr]

hm... and you don' t have any special characters on your group name... and this group is also from the same AD group type like the ones that work for you?

[clarkg]

hm... and you don' t have any special characters on your group name... and this group is also from the same AD group type like the ones that work for you?

No special characters. In fact, this morning, I deleted the group, and recreated it with no spaces. And yes, I have many other global and universal security groups that work just fine.

[rwpatterson]

Perhaps the browser you are using is caching artifacts...since you can see it from the GUI.

[clarkg]

Perhaps the browser you are using is caching artifacts...since you can see it from the GUI.

Tried IE, chrome and firefox. Same result in all of them.

[rwpatterson]

ORIGINAL: clarkg Tried IE, chrome and firefox. Same result in all of them.

Which versions? Check the release notes for your version of code. V4.3.0 states: IE 8+ Firefox 3.5+ Chrome is not officially supported. V4.3.11 states: Supported web browsers • Microsoft Internet Explorer 8, and 9 • Mozilla FireFox 15.0, and 16.0 Chrome is not officially supported. V5.0.0 states: Supported web browsers • Microsoft Internet Explorer 8 and 9 • Mozilla FireFox 15.0 and 16.0 • Google Chrome 22.0

[clarkg]

V5.0.0 states: Supported web browsers • Microsoft Internet Explorer 8 and 9 • Mozilla FireFox 15.0 and 16.0 • Google Chrome 22.0

Hmmm. well, I was on IE 10, firefox 21 and chrome 26. I reverted to IE9, and still same error

[romanr]

I din' t have any further clue. Hope you get soon a good result with your support case. Please keep us updated on this trouble!! br, Roman

[Anne]

To my knowledge, the new groups you create in your AD do not automatically show up on the User & Device/User/ User Group/available members on the Fortigate. Those users need to generate a logon event which is passed onto Fortigate which populates the member List. Make sure that you logon your Domain with the new user accounts, followed by using " execute fsso refresh" and other debug commands mentioned above. Thanks Anne