topic Identity Provider to FMC - Scaling Question in Network Access Control

Identity Provider to FMC - Scaling Question

mulatif — Thu, 08 Mar 2018 03:25:23 GMT

Hi,

I have a Firepower customer looking for identity integration within Firepower management center. We have been exploring the identity integration with pxGrid but the scale is bringing up questions on deployment options.

The customer has around 250(!) domain controllers, which means around 25 AD-Agents. Do we have any examples on this scale ?
Would another option like SPAN or Logs might be a better approach ?
1. There is an existing Qradar deployment with WMI integration to AD. Can that data be utilized by pxGrid and then fed into FMC ? Just checking, if this has been seen at any other customer.

Open to other ideas..

Naman

Re: Identity Provider to FMC - Scaling Question

Craig Hyps — Thu, 08 Mar 2018 04:46:15 GMT

Max limit per ISE / ISE-PIC instance is 100 DCs today. If require monitoring of more DCs, then deploy multiple ISE/PIC instances. See ISE Performance & Scale

Remember, it is only needed to get identity for DCs that authenticate users and where need to apply policy based on the users logging into that DC. Although not officially QA tested, we have tested internally the use of log event forwarding which could be used to forward logs from multiple DCs to a single DC for collection.

If the Qradar deployment generates logs for each event, then Syslog could be used to parse user/IP mappings.

Craig