Authorization on AD group for L2TP does not pass

Zywall 310 / fw 4.35 (AAAB.3)

For L2TP users, a local group (L2TP-VPN-users) in Zywall has been created, where those who are allowed access to VPN (allowed users) are placed.

AD authentication was configured, an ad-users internal user was added to the L2TP-VPN-users group. As a result, all users of the domain and local are authorized and connected.

But as soon as you try to allow authorization only for users belonging to a certain AD group (ext-group-user). Authorization fails ("disallowed user" in logs)

Group authorization is as follows - An AD-VPN user of the ext-group-user type is created. with settings defining the AD group. When testing inside the ext-group user test, the test passes - the status is OK.

The created user (AD-VPN) was added to the VPN allowed group (L2TP-VPN-users), and the ad-users built-in user was removed from the allowed group. After that, authorization through AD does not work.