![background image](http://html.mh-extra.com/html/cisco/5505-asa-firewall-edition-bundle/5505-asa-firewall-edition-bundle_cli-configuration-manual_18624546.webp)
1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Objects
Configuring Objects
The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the
Active Directory domain controller. The ASA imports these groups for identity-based rules. However,
the ASA might have localized network resources that are not defined globally that require local user
groups with localized security policies. Local user groups can contain nested groups and user groups that
are imported from Active Directory. The ASA consolidates local and Active Directory groups.
A user can belong to local user groups and user groups imported from Active Directory.
Prerequisites
See
Chapter 1, “Configuring the Identity Firewall,”
to enable IDFW.
Detailed Steps
Command
Purpose
Step 1
object-group
user
user
_
group_name
Example:
hostname(config)#
object-group user users1
Defines object groups that you can use to control access with the
Identity Firewall.
Step 2
Add one or more of the following group members:
user
domain_NetBIOS_name
\
user_name
Example:
hostname(config-user-object-group)#
user
SAMPLE\users1
Specifies the user to add to the access rule.
The
user_name
can contain any character including [a-z], [A-Z],
[0-9], [!@#$%^&()-_{}. ]. If
domain_NetBIOS_name
\
user
_
name
contains a space, you must enclose the domain name and user
name in quotation marks.
The
user
_
name
can be part of the LOCAL domain or a user
imported by the ASA from Active Directory domain.
If the
domain_NetBIOS_name
is associated with a AAA server,
the
user
_
name
must be the Active Directory sAMAccountName,
which is unique, instead of the common name (cn), which might
not be unique.
The
domain_NetBIOS_name
can be LOCAL or the actual domain
name as specified in
user
-
identity
domain
domain_NetBIOS_name
aaa
-
server
aaa
_
serve
r_
group
_
tag
command.
group-object
group_id
Example:
hostname(config-network)# group-object
Engineering_groups
Adds an existing object group under this object group. The nested
group must be of the same type.
Step 3
description
text
Example:
hostname(config-protocol)# description New
Group
(Optional) Adds a description. The description can be up to 200
characters.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......