LDAP User Group Mirroring (SonicOS 5.9.0.0)

03/26/2020 38 15270

DESCRIPTION:
This article describes how to setup and use LDAP user group mirroring. This article applies to SonicOS 5.9.0. and above.

RESOLUTION:

LDAP User Group Mirroring provides automatic duplication of LDAP User Group configurations from an LDAP server to a SonicWall Security Appliance. Administrators can manage LDAP User Groups exclusively on the LDAP server and do not need to manually duplicate configurations on the SonicWall Security Appliance. User group configurations are periodically read from the LDAP server and copied to the SonicWall Security Appliance.

LDAP User Group names that are copied to the SonicWall Security Appliance include the domain name in the format: name@domain.com. This ensures that user group names from various domains are unique.

The following features and restrictions apply to mirrored LDAP User Groups:

• Administrators can add users as members to an LDAP User Group on the SonicWall Security Appliance.
• Administrators cannot add groups to other groups on the SonicWall Security Appliance. Default user groups can only be configured on the LDAP server.
• Administrators can delete LDAP User Groups only on the LDAP server. They cannot delete the mirrored LDAP User Groups on the SonicWall Security Appliance. When a user group is deleted on the LDAP server, its mirrored group on the SonicWall Security Appliance is also automatically deleted.
• Administrators can edit LDAP User Group names (and their comment boxes) only on the LDAP server. They cannot edit the mirrored LDAP User Group name or its comment box on the SonicWall Security Appliance. The comment box displays “Mirrored from LDAP” on the SonicWall Security Appliance.
• Administrators can configure features such as VPNs, SSL VPNs, CFS policies, and ISP policies for LDAP User Groups on the SonicWall Security Appliance, when they are configurable under configuration pages such as Firewall > Access Rules or Firewall > App Rules.
• When you disable LDAP User Group Mirroring, the mirrored user groups on the SonicWall Security Appliance are not deleted. They are changed so that they can be deleted manually by an administrator. Local mirrored user groups can be re-enabled if they have not been deleted manually.
• When the system creates a mirrored group on the SonicWall Security Appliance, and the name of the mirrored group matches the name of an already existing, user-created (nonmirrored) local group, the local group is not replaced. The local group memberships are updated to reflect the group nestings that are configured on the LDAP server.
• If the system finds a user group on the LDAP server with a name that is the same as one of the default user groups on the SonicWall Security Appliance, no mirrored user group is created on the SonicWall Security Appliance. The memberships in the default user group are updated to reflect the group nestings that are configured on the LDAP server.
• For groups created before SonicOS 5.9, if a local user group exists on the SonicWall Security Appliance with a simple name only (no domain) and that name matches the name of a user group on the LDAP server (which includes a domain), a new local user group is created on the SonicWall Security Appliance and is given the same domain as the corresponding user group on the LDAP server. The original local user group is retained with no domain. Users of the original group are given memberships in the LDAP group, the new local mirrored group, and the original local group (with no domain).

Procedure:

Configure LDAP User Group mirroring

01. Login to the SonicWall management GUI
02. Navigate to the Users | Settings page.
03. Select LDAP or LDAP + Local Users under Authentication method for login.
04. Click on Configure LDAP to open LDAP Configuration window
05. Navigate to the Users & Groups tab
06. Enable check-box Mirror LDAP user group locally
07. Select radio-button All user groups on the LDAP server or Only groups that have member users or groups
08. Clicking on Refresh Now will import the user groups from the AD.
09. Click on OK to save. This will import the user groups from the AD.



Configure mirrored LDAP user group

01. Navigate to Users | Local Groups. The User Groups from AD will be listed under Groups Mirrored From LDAP.
02. Click on the configure button on the user group to be configured.



Administrators can configure the following in the user group window.

• Add members to the group.
• Add VPN Access List
• Set CFS policies
• Add Bookmarks (If part of SSLVPN Services group)

When LDAP User Group Mirroring is disabled, the mirrored user groups on the SonicWall Security Appliance are NOT deleted. They will be merged under Local Groups and they are changed so that they can be deleted manually by an administrator. Local mirrored user groups can be re-enabled if they have not been deleted manually.

Note

LDAP User Groups are not deleted if they are configured in any Access Rules, App Rules, or policies.