topic User-to-IP mapping on FMC in Network Security

User-to-IP mapping on FMC

Turbo727 — Mon, 30 Aug 2021 04:22:14 GMT

We have FTD-A as a VPN firewall that authenticates remote users against LDAP and assigns IP addresses.

What we are trying to achieve is a user-based policy applied on FTD-B, but we are having problems identifying users when they are connected to VPN.

What is the best way to push User-to-IP mapping from FTD-A to FTD-B? Both are managed by the same FMC.

Re: User-to-IP mapping on FMC

Chakshu Piplani — Mon, 30 Aug 2021 08:29:09 GMT

Are your FTD-A and B in HA?

Re: User-to-IP mapping on FMC

Turbo727 — Mon, 30 Aug 2021 08:30:37 GMT

No. They are different firewalls.

Re: User-to-IP mapping on FMC

Chakshu Piplani — Mon, 30 Aug 2021 18:08:20 GMT

I dont think that's a possibility as they are treated as separate device.

Re: User-to-IP mapping on FMC

Milos_Jovanovic — Mon, 30 Aug 2021 19:39:41 GMT

Hi @Turbo727,

You won't be able to do this, without intermediate device.

What you need in between is ISE for this purpose. For VPN use-case, it would serve as RADIUS server, responsible for authentication and authorization, while collecting User-to-IP mapping at the same time. For FTD-B use-case, it would serve as identity source (role called Passive Identity, please see more here).

BR,

Milos