topic Hello Avram, in Network Security

Network Users Discovery.

n.avramenko87 — Tue, 12 Mar 2019 13:04:23 GMT

Hello! It's me again.Read all the documentation but have not found the answer. Problem with Network Discovery with users.

I have created:

1.Policy - Network Discovery - Network - Here I added networks, zone and actions (discover user host application)

2.Policy - Network Discovery - Users - Here add all protocols

Then created:

3.Policy - access control - with some rules (use discovery only by default)

How I understand for first time that all. But the system can not find users (It is find only users that use FTP)

May be it is need to use NetFlow Devices? What am I doing wrong? Thank you!

Hi

yogdhanu — Thu, 14 Jul 2016 03:11:27 GMT

Network discovery does discover hosts and applications but this cannot be used in access control policy for user based rules.

Network discovery's primary usage is for IPS policies firesight recommendation and awareness about the user data in firesifght.

For access control policies, Firepower needs to have user-ip mapping based on which it can apply the rules.

You would need user agent which can get the user IP mapping and then this whole config on firepower which will work along with that.

http://www.cisco.com/c/en/us/support/docs/security/asa-firepower-services/200329-Configure-Active-Directory-Integration-w.html

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118131-technote-sourcefire-00.html

The above articles will help.

Rate if helps.

Yogesh

Hello Avram,

Jetsy Mathew — Thu, 14 Jul 2016 04:24:40 GMT

Hello Avram,

As I told you in some of the previous replies for your Useragent queries last week , user based access control policies can be created only by installing the Firepower Useragent. Once the user agent is installed properly you can create the AC policy based on specific users. Navigate to Policies > Access Control > Rules > Users - Under users you should be able to search for the users that you fetched from the AD. If you are not able to fetch the users , that means the user agent installation or communication is not proper.

Rate if the post helps you.

Regards

Jetsy

THANK YOU! Sorry for my

n.avramenko87 — Thu, 14 Jul 2016 06:04:48 GMT

THANK YOU! Sorry for my stupidity!

Here:Navigate to Policies > Access Control > Rules > Users I see users and groups that I added in Users - LDAP Connections . This means that all must work. I will check! Thak you for your time.

I think i found my problem!

n.avramenko87 — Thu, 14 Jul 2016 10:21:01 GMT

I think i found my problem! It is problem with access to DC. I try to install agent to another computer (not domain) and have error - unable to read security log on DC. Trying to solve! P.S. very strange - I have not this error if I try to add AD in agent that installed on DC.

Hi

yogdhanu — Thu, 14 Jul 2016 15:02:33 GMT

Use this to verify the permission.

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118159-troubleshoot-firesite-00.html

Hope it helps

Yogesh

O GODS) I find mistake)

n.avramenko87 — Fri, 15 Jul 2016 08:53:56 GMT

O GODS) I find mistake) Problems were with politics on domain.

Enable Audit Logoff. Enable Audit Logon. A now I see users. Woooo!!! Error An error occured while fetching encryption bytes from 'C:\UserAgentEncryptionBytes.bin': Specified key is not a valid size for this algorithm.." is left. But see users! YHANK YOU!

Hello,

Jetsy Mathew — Fri, 15 Jul 2016 09:09:33 GMT

Hello,

Please check that the file UserAgentEncryptionBytes.bin file is present and has a size greater than 0.

Delete UserAgentEncryptionBytes.bin

Enable the Cisco User Agent Service to run as a different user:

Please follow the steps :-

Open the Service console

Start > Run > services.msc (or through Administrative Tools)

Right Click and Choose Properties for Cisco Firpower User Agent

Select Log On tab

Specify a known account with proper rights to run the service

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html

Appl and Start the Service

Verify the C:\UserAgentEncryptionBytes.bin is recreated and has a size greater than 0

Rate if the post helps you

Regards

Jetsy

O! I already try to do this

n.avramenko87 — Fri, 15 Jul 2016 11:39:51 GMT

O! I already try to do this.And i did not help me. Yes. size of this file 0 bytes.

I dont use the agent, and I

Ed Padilla Jr — Fri, 15 Jul 2016 17:59:11 GMT

I dont use the agent, and I can manage get user information, by using the LDAP authentication module. Making sure you capture in the Org all the parameters. Haven's said that, using the User Agent at the Domain controller is the prefer way. You need to work with the Windows Admin, and check all the policies, and logging, ports, etc. Happy troubleshooting

HEllo friends! Thank you for

n.avramenko87 — Thu, 21 Jul 2016 06:31:29 GMT

HEllo friends! Thank you for your advices! I not use agent! How I understant it needed only if I want use access policy in firepower. I do not need it! I see all my users and theirs activity.

Congratulations!

Ed Padilla Jr — Mon, 25 Jul 2016 15:19:22 GMT

Congratulations!