topic hi, did you solve this? in Network Security

AD & FireSIGHT Integration

MuhammadEisa — Tue, 12 Mar 2019 12:48:32 GMT

Hello all
in my company we have ASA 5545 with firepower module on
we made integration between the AD and the firesight. also we have clearpass and we integrate the AD with the AD to force raduice to all users from domain
the case now any user login from a device joined the domain events recorded everything by the username, but if come from other device not joined
the domain but go throw the radius and the radius authenticate from AD , why i dont see his name , i only get his IP

where is the problem in my case

should i look more at clearpass config , or it related to AD or to the firesight ?

help ASAP

Hi,

Aastha Bhardwaj — Wed, 04 Nov 2015 18:15:35 GMT

Hi,

I dont think it will be Firesight , but to confirm you can first check the AD event logs and search for that username ,check if you see the LOGON event corresponding to it. If yes then you can check the User agent logs and check the same. If User agent polls the username then User agent will foward the same thing to the Firesight Manager.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

after checking the log file i

MuhammadEisa — Sat, 07 Nov 2015 09:17:51 GMT

after checking the log file i found

Checking x.x.x.x for user momo @x Failed. Does admin have permission to see all processes on x.x.x.x

this log for non domain labtop, but auth by the clearpass radius

- logoff memo@x (x.x.x.x)

Checking x.x.x.x for user memo@x. Found

this log for joined domain device

so now is the problem related to the user i use to auth with the domain on asa
or it related to the domain it self that it cant resolve the non domain devices
it can resolve the joined domain perfect , so
is someone face this problem before ?

Hi,

Aastha Bhardwaj — Mon, 09 Nov 2015 22:02:19 GMT

Hi,

I would recommend you to open up a case with Cisco TAC because we would need to check a few things before jumping on some conclusion.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

i will check and update here

MuhammadEisa — Tue, 10 Nov 2015 13:42:09 GMT

i will check and update here

hi, did you solve this?

Jose Carlos Sm de Lima — Fri, 24 Mar 2017 21:51:40 GMT

hi,

did you solve this?