Difference between "user-identity domain" & "user-identity default-domain"

AlexFer — Sat, 07 Mar 2020 04:46:08 GMT

Hi Experts,

ASA configuration guide lists both "user-identity domain" and "user-identity default-domain" in relations to a single identity-firewall configuration, often with same "nickname" and "NETBIOS_name" respectively, (IMO) without clarifying the specifics of each commands.

What does each command do, and are they independent of each other?

R's, Alex

Re: Difference between "user-identity domain" & "user-identity default-domain"

Cristian Matei — Sat, 07 Mar 2020 12:12:52 GMT

Hi,

When you define a "user-identity-domain" you link it to a pre-defined AAA LDAP servers, and this feature is used for user-group mapping polling:

aaa-server FIRST_DOMAIN protocol ldap

aaa-server (INSIDE) FIRST_DOMAIN host 10.10.10.10

ldap-base-dn dc=colocvium,dc=com

aaa-server SECOND_DOMAIN protocol ldap

aaa-server (INSIDE) SECOND_DOMAIN host 20.20.20.20

ldap-base-dn dc=cisco,dc=com

When you configure the identity-based rules in your ACL, if you fail/forget to specify also the domain name for the user, it will pick up the configured domain from "user-identity default-domain", which by default is LOCAL (meaning the LOCAL user database); this is the scope of this command. If you want to change it from the default of "LOCAL" to something custom, it needs to be one of the domain previously configured via the aaa-server protocol ldap commands, otherwise it gives an error, which makes sense.

Regards,

Cristian Matei.

topic Re: Difference between "user-identity domain" & "user-identity default-domain" in Network Security

Difference between "user-identity domain" & "user-identity default-domain"

Re: Difference between "user-identity domain" & "user-identity default-domain"