topic Re: ISE cannot sent TS port range to FMC in Network Access Control

ISE cannot sent TS port range to FMC

csco11552159 — Fri, 06 Jul 2018 18:48:01 GMT

i got TS agent working with ISE 2.2 .

on ISE 2.2, I can see the User ID, IP and Port range mapping in live session table.

But on FMC, it doesnt show these information.

If i use TS agent directly sent to FMC, it will work.

Is this some kind of bug between ISE and FMC?

Because TS agent only allow to send mapping to 2 servers, if we need to see all user identity information on ISE and also works on FMC, so we have to send to both ISE and FMC, we will lose redundancy.

it doesnt make sense.

Re: ISE cannot sent TS port range to FMC

hslai — Fri, 06 Jul 2018 21:23:17 GMT

I think it might be expected at present. I will check with our teams.

Re: ISE cannot sent TS port range to FMC

csco11552159 — Fri, 06 Jul 2018 21:36:12 GMT

Thank you.

and on FMC, in this way will only keep the last user login.

Re: ISE cannot sent TS port range to FMC

hslai — Fri, 06 Jul 2018 23:08:13 GMT

Some info from our PM indicated that our teams are still working on this to make it more consumable.

Re: ISE cannot sent TS port range to FMC

jeppich — Fri, 06 Jul 2018 23:09:55 GMT

Hey Chao,

Hsing-Tsu is correct, this is expected behavior. Please see: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/user_identity_sources.html

"If the TS Agent monitors the same users as another passive authentication identity source (the User Agent or ISE), the Firepower Management Center prioritizes the TS Agent data. If the TS Agent and a passive identity source report activity by the same IP address, only the TS Agent data is logged to the Firepower Management Center"

Thanks,

John

jeppich@cisco.com

Re: ISE cannot sent TS port range to FMC

csco11552159 — Sat, 07 Jul 2018 02:00:12 GMT

hi John & Hsing-Tsu,

So in order FMC to have correct User ID, port and IP mapping, TS-Agent directly send to FMC? like this:

TS-Agent--->FMC

ISE---(pxgrid)--->FMC

the way we try to do is :

TS-Agent--->ISE ----(pxgrid)--->FMC.

We can use TS-Agent to send mapping to ISE, then we should easily send all ID mapping to FMC via pxgrid including regular mapping and TS ports mapping. this more make sense.

Will this way work?

Re: ISE cannot sent TS port range to FMC

hslai — Sat, 07 Jul 2018 02:51:47 GMT

Unfortunately it's not quite there yet.

I would suggest you to use TS-Agent => FMC for now, while the solution is still being evolved and developed for the other route.

Re: ISE cannot sent TS port range to FMC

csco11552159 — Tue, 10 Jul 2018 13:04:32 GMT

thank you.

i will send to FMC for now. hopefully some changes coming soon.