topic Hi, in Network Security

Sourcefire 6.0 / FireSIGHT MC 6.0 - Users Not Populating

Keith Joel — Tue, 12 Mar 2019 12:53:16 GMT

Edit: moved to Sourcefire category.

---

Hi All,

Wondering if somebody can lead me in the right direction here, I have a customer running Sourcefire 6.0 with the FireSIGHT MC and am having an issue with the IP to User mapping. Under Analysis > Users > Users I don't have any records. I've gone in and setup the "realm" under itnegration which tests out ok, and setup the user download which pulls down the groups so I know the linkage for the "realm" is there. The tasks show LDAP synch with 2 groups and 293 Users successful. Identity Policy was setup with passive authentication and the User Agent on the active directory system is installed and tested successfully. I noticed the following in the syslogs stored locally (changed hostname and users) and I'm wondering if it has something to do with it?

Any other information required let me know.

Thanks,

Keith

Hi,

Aastha Bhardwaj — Thu, 04 Feb 2016 00:06:24 GMT

Hi,

Check this : https://tools.cisco.com/bugsearch/bug/CSCux39125/?reffering_site=dumpcr

To get users correctly associating with their IP addresses, the fix is to change the "AD Primary Domain" field in the Realm configuration to the short name of the domain. This name is visible in the message found in /var/log/messages .

After changing this field, save the realm configuration and make sure that user download continues to work as expected.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Bingo. That did it, thanks

Keith Joel — Thu, 04 Feb 2016 20:21:17 GMT

Bingo. That did it, thanks so much.

Given the bug is resolved in a future update, will the domain need to be changed back from the short name?

Hi,

Aastha Bhardwaj — Fri, 05 Feb 2016 17:43:59 GMT

Hi,

Yes later if you upgrade the FMC to the version on which it is resolved you should be able to change the name back to what it was originally.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Thankfully I stumbled across

Jarvis IT — Thu, 18 Feb 2016 05:29:18 GMT

Thankfully I stumbled across this today, I have had a SR open for a couple of weeks now after integrating ISE v1.4 and Source fire v6.0 through PXGrid. Once I changed this I started to see the users populate with a realm! Thank you!