Cisco ASA Series Cli Configuration Manual page 546

Configuring Objects
The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the
Active Directory domain controller. The ASA imports these groups for identity-based rules. However,
the ASA might have localized network resources that are not defined globally that require local user
groups with localized security policies. Local user groups can contain nested groups and user groups that
are imported from Active Directory. The ASA consolidates local and Active Directory groups.
A user can belong to local user groups and user groups imported from Active Directory.
Prerequisites
See
Detailed Steps
Command
Step 1
object-group user user_group_name
Example:
hostname(config)# object-group user users1
Step 2
Add one or more of the following group members:
user domain_NetBIOS_name\user_name
Example:
hostname(config-user-object-group)# user
SAMPLE\users1
group-object group_id
Example:
hostname(config-network)# group-object
Engineering_groups
Step 3
description text
Example:
hostname(config-protocol)# description New
Group
Cisco ASA Series CLI Configuration Guide
1-12
Chapter 1, "Configuring the Identity Firewall," to enable IDFW.
Purpose
Defines object groups that you can use to control access with the
Identity Firewall.
Specifies the user to add to the access rule.
The user_name can contain any character including [a-z], [A-Z],
[0-9], [!@#$%^&()-_{}. ]. If domain_NetBIOS_name\user_name
contains a space, you must enclose the domain name and user
name in quotation marks.
The user_name can be part of the LOCAL domain or a user
imported by the ASA from Active Directory domain.
If the domain_NetBIOS_name is associated with a AAA server,
the user_name must be the Active Directory sAMAccountName,
which is unique, instead of the common name (cn), which might
not be unique.
The domain_NetBIOS_name can be LOCAL or the actual domain
name as specified in user-identity domain
domain_NetBIOS_name aaa-server aaa_server_group_tag
command.
Adds an existing object group under this object group. The nested
group must be of the same type.
(Optional) Adds a description. The description can be up to 200
characters.
Chapter 1 Configuring Objects