City NSX Manager is bound to Active Directory, but Identity Firewal…

Question

City NSX Manager is bound to Active Directory, but Identity Firewall cannot enumerate finance users because the LDAP service account has no read permission on the user OU. What should the administrator fix first?

Accepted Answer

Grant the NSX Manager directory bind account read access to the user and group OUs used by Identity Firewall — NSX is asking AD who is in Finance with a service account that cannot even open that OU. Fix the bind account’s read rights—do not blow a hole in the default DFW rule.

Answer

Change the distributed firewall default rule from Drop to Allow so unmapped users pass

Answer

Replace the bind account with the vCenter Single Sign-On administrator

Answer

Disable LDAPS so the bind account can skip OU permissions

City NSX Manager is bound to Active Directory, but Identity Firewall cannot enumerate finance users because the LDAP service account has no read permission on the user OU. What should the administrator fix first?

Short Explanation

Full Explanation