topic Hi guys, in Network Security

Install Cisco Firepower User Agent for Active Directory.

n.avramenko87 — Tue, 12 Mar 2019 13:03:50 GMT

OO!Hello! Have one problem! Install this agent on active directory. (Service working with domain - admin rules)

In FireSight:

In Policy -- Users add FirePowerAgent (it found active directory -all good!) and User Agent (here i check ip address of AD server).

In Firepower User Agent for Active Directory:

In Cisco Firepower User Agent for Active Directory I added host (server AD) - all good it has status - available.

In FP managment center I added FireSight. But after few minutes its state became unavailable.

I have log: Unable to report heartbeat to 192.168.0.100. - A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond"

But i see that all devices are available. What it is mean? Thank you!!!

Hello Team,

Jetsy Mathew — Wed, 06 Jul 2016 14:45:06 GMT

Hello Team,

Looks like from logs of the Cisco Firepower User Agent that the connectivity to the Firepower Management Center from the User Agent was inconsistent -- but sometimes working. I would advice in checking the network path between the FMC and the User Agent system to ensure that TCP port 3306 (to which the User Agent connects to the FMC) was not being blocked in any way.

Also recommended ensuring that the FMC was properly configured to accept connections from the User Agent.

Here is the user installation guide once again :-

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118131-technote-sourcefire-00.html

Please review the following link to make sure that the configurations has been properly done.

http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118738-configure-firesight-00.html

If you see the issue persist , kindly uninstall and install the user agent once again.

Rate if this post and answer helps you

Regards

Jetsy

Thank you for your help!

n.avramenko87 — Wed, 06 Jul 2016 14:45:07 GMT

Thank you for your help!

I thought there are differences between Sourcefire User Agent monitors Microsoft Active Directory and User Agent.

Hello Team,

Jetsy Mathew — Wed, 06 Jul 2016 14:45:08 GMT

Hello Team,

I hope everything is clear for you now.

Feel free to let me know if you have any questions.

Rate and mark correct if this posts and answers helps you

Regards

Jetsy

I try to install version 2.2.

n.avramenko87 — Wed, 06 Jul 2016 14:52:36 GMT

I try to install version 2.2. Now I having another error in logs: Unable to report heartbeat to 192.168.0.100. - Unable to connect to any of the specified MySQL hosts."

Hello Team,

Jetsy Mathew — Wed, 06 Jul 2016 15:03:09 GMT

Hello Team,

If you are reinstalling , please use the Sourcefire useragent version 2.3 which is more stable than 2.2. So please install the 2.3 Sourcefire useragent issue.

For the error , "Unable to connect to any of the specified MySQL hosts"

Clearly, this indicates that something is blocking the connection from the system where the User Agent is running to the Firepower Management Center. The User Agent system must have the ability to send traffic to the FMC to TCP port 3306. Additionally, the FMC needs to have the User Agent configured on it -- that is, within the user policy, the User Agent needs to be configured. This is how the FMC will know to allow incoming connections on TCP port 3306 from the system where the User Agent is running.

Rate if the post helps you

Regards

Jetsy

OK! I will try! And tell you

n.avramenko87 — Wed, 06 Jul 2016 15:11:01 GMT

OK! I will try! And tell you my result. Thank you!

Sure ...No worries

Jetsy Mathew — Wed, 06 Jul 2016 15:16:21 GMT

Sure ...No worries

I installed version 2.3. Now

n.avramenko87 — Thu, 07 Jul 2016 07:07:11 GMT

I installed version 2.3. Now sensor is available few minutes only. And i have another error in logs:

An error occured while fetching encryption bytes from 'C:\UserAgentEncryptionBytes.bin': Specified key is not a valid size for this algorithm.."

I think may be problem with antivirus. I try to switch off it...

Hello Team,

Jetsy Mathew — Thu, 07 Jul 2016 07:33:18 GMT

Hello Team,

Make sure that the user that you are using for handling the Useragent should have all the admin privileges. Preferably use administrator itself.

Try restarting Firepower useragent service using administrator and see the status if its continuosly available or not.

Also switch off the antivirus if its blocking the file.

Rate if the post helps you

Regards

Jetsy

THANK YOU!ALL GOOD! Problem

n.avramenko87 — Thu, 07 Jul 2016 10:12:34 GMT

THANK YOU!ALL GOOD! Problem was with antivirus. How long does it take for agent to collect an information about users?

Hello,

Jetsy Mathew — Thu, 07 Jul 2016 10:13:55 GMT

Hello,

Its based on the polling interval.

What you have set the polling interval time in AD ?

Regards

Jetsy

I have 1 min for polling and

n.avramenko87 — Thu, 07 Jul 2016 10:46:34 GMT

I have 1 min for polling and 1 hour for MaxPolling.

Hello Team ,

Jetsy Mathew — Thu, 07 Jul 2016 11:07:13 GMT

Hello Team ,

Its fine as of now.

Regards

Jetsy

Hello ,

Jetsy Mathew — Thu, 07 Jul 2016 12:02:09 GMT

Hello ,

Does all your queries are clear ?

Regards

Jetsy

HELLO! All green! There are

n.avramenko87 — Thu, 07 Jul 2016 14:10:48 GMT

HELLO! All green! There are no errors. But unfortunately Managment Center does not receive information in user activity. MAy be I need to wait...

Hello team

Jetsy Mathew — Thu, 07 Jul 2016 14:31:47 GMT

Hello team

If tge posts helped or if its correct please mark them.

You dont have to wait much for receiving user login log off events.

Are you able to create access control policy based on the users?

Verify that the logging has been enabled in the AD server so that whenever user logon and logoff AD will generate events so that Useragent will send the same to User activities .

Regards

Jetsy

Thank you for your time! I

n.avramenko87 — Thu, 07 Jul 2016 14:53:55 GMT

Thank you for your time! I did not create access control policy based on the users. Is it mandatory?

Hello,

Jetsy Mathew — Fri, 08 Jul 2016 07:38:42 GMT

Hello,

Its not mandatory. Is everything works now ?

Regards

Jetsy

Thank you. And sorry for the

n.avramenko87 — Fri, 08 Jul 2016 09:32:56 GMT

Thank you. And sorry for the trouble. Can't get that to work.

After this night i have another error in log: Unable to connect to any of the specified MySQL hosts. And Agent does not see Center Again.