Importing Active Directory Domain Users

Hello Mark Andersen ,

Thank you for reaching out to the community, please refer the following useful docs below that may help mitigate your situation: 
1.)  Import export - https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/BackupAndFirmware/ImportExport/index.html
2.)  Creating XML Objects with notepad++ for mass import - Creating XML Objects with notepad++ for mass import
3.)  Backup-restore compatibility check - https://support.sophos.com/support/s/article/KB-000036245?language=en_US

i saw these links before
1- both devices using same OS version and ....
2- users aren't inside XML file because users contain sensitive info, so i'm unable to edit xml file to achieve my requirements.
3- i'm using export and import, not Backup and restore.

On the virtual appliance is the same AD integration configured ?

after importing, the  active directory integration is added and visible on virtual appliance

Is the test connection successful ? And are the groups visible in the group section ?

Hi Mark Andersen : Can you please use the below command on Virtual Appliance and share the output here? If no output then performs the export operation again and try to run the command again to see getting any logs after performing the export operation.

#grep "packet ran out of space" /log/csc.log

For "readAPIInterface" operation has packet ran out of space log lines then it seems Appliance is impacted with the known issue NC-108238 which is going to be fixed in V19.5 MR-2.  In case any validation on the log verification side is required please log a support case, so the Support team may review the required logs and give further updates.

yes test connection is successfull and all groups are imported

Hi

output:

SFVUNL_SO01_SFOS 19.5.0 GA-Build197# grep "packet ran out of space" /log/csc.log
Readobject Executing PREPSTMT Query= (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::IPHost' as reftype_exceptionid from tblhost ,tblfwexception where tblfwexception.exceptionid =tblhost.hostid and hosttype in (1,2,3,4,7,9,10,15,16,17) and tblfwexception.fwruleid = '50') UNION (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::IPHostGroup' as reftype_exceptionid from tblhost ,tblfwexception where tblfwexception.exceptionid =tblhost.hostid and hosttype in (8) and tblfwexception.fwruleid = '50') UNION (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::MacHost' as reftype_exceptionid from tblhost ,tblfwexception where tblfwexception.exceptionid =tblhost.hostid and hosttype in (5,6) and tblfwexception.fwruleid = '50') UNION (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::FqdnHost' as reftype_exceptionid from tblhost ,tblfwexception where tblfwexception.exceptionid =tblhost.hostid and hosttype in (11,18) and tblfwexception.fwruleid = '50') UNION (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::FqdnHostGroup' as reftype_exceptionid from tblhost ,tblfwexception where tblfwexception.exceptionid =tblhost.hostid and hosttype in (12) and tblfwexception.fwruleid = '50') UNION (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::CountryHost' as reftype_exceptionid from tblhost ,tblfwexception where tblfwexception.exceptionid =tblhost.hostid and hosttype in (13) and tblfwexception.fwruleid = '50') UNION (select tblhost.hostid as ref_exceptionid,hostname as exceptionid,'object::CountryHostGroup' as reftype_exceptiERROR Sep 14 15:57:14Z [readobject:10553]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query=select tblnetworkzone.zoneid as ref_srczones,zonename as srczones,'network::zone' as reftype_srczones from tblnetworkzone ,tblfwsourcezone where tblfwsourcezone.sourcezoneid =tblnetworkzone.zoneid and tblfwsourcezone.fwERROR Sep 14 15:57:33Z [readobject:11636]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query= (select tblfirewallgroup.groupid as ref_groupid,groupname as groupid,'firewaERROR Sep 15 07:00:09Z [readobject:2922]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query=select tblnetworkzone.zoneid as ref_srczones,zonename as srczones,'network::zone' as reftype_srczones from tblnetworkzone ,tblfwsourcezone where tblfwsourcezone.sourcezoneid =tblnetworkzone.zoneid and tblfwsourcezone.fwERROR Sep 15 07:00:51Z [readobject:3089]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query= (select tblhost.hostid as ref_sourceid_exception,hostname as sourceid_exception,'object::IPHost' as reftype_sourceid_exception from tblhost ,tblfwsource_exception where tblfwsource_exception.hostid =tblhost.hostid and hosttype in (1,2,3,4,7,9,10,15,16,17) and tblfwsource_exception.fwruleid = '27') UNION (select tblhost.hostid as ref_sourceid_exception,hostname as sourceid_exception,'object::IPHostGroup' as reftype_sourceid_exception from tblhost ,tblfwsource_exception where tblfwsource_exception.hostid =tblhost.hostid and hosttype in (8) and tblfwsource_exception.fwruleid = '27') UNION (selERROR Sep 15 07:09:13Z [readobject:4471]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query=select tblnetworkzone.zoneid as ref_srczones_exception,zonename as srczones_exception,'network::zone' as reftype_srczones_exception from tblnetworkzone ,tblfwsourcezone_exception where tblfwsourcezone_exception.sourcezoneid ERROR Sep 15 07:09:59Z [readobject:5439]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query= (select tblfirewallgroup.groupid as ref_groupid,groupname as groupid,'firewaERROR Dec 13 05:58:33Z [readobject:2973]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)
Readobject Executing PREPSTMT Query= (select tbluser.userid as ref_userid,username as userid,'identity::User' as reftype_userid from tbluser ,tblfwuser where tblfwuser.userid =tbluser.userid and usertype in (1,5,7) and tblfwuser.fwruleid = '30') UNION (select tbluser.userid as ref_userid,username as userid,'identity::UserGroup' as reftype_userid from tbluser ,tblfwuser where tblfwuser.userid =tbluser.userid and usertype in (3,4,10) and tblfwuser.fwruleid = '30') UNION (select tbluser.userid as ref_userid,username as userid,'identity::clientlessuser' as reftype_userid from tbluser ,tblfwuser where tblfwuser.userid =tbluser.userid and usertype in (2) and tblfwuser.fwruleid = '30') UNION (select ERROR Dec 13 05:59:24Z [readobject:3246]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)

Hi Mark Andersen  Yes it seems related to the same reason and error observed with NC-108238

[readobject:10553]: fill_reply(RET_DONE, BODY): packet ran out of space(size=65499,remlen=65445,need=88227)

Dear Vishal
thank you.
is this issue exist in firmware's before 19.5?
i can downgrade both device's firmware to 19 or 18.5, if issue related to 19.5 downgrading whill solve the problem
Best Regards