topic ASA5516-X: Usefulness of the AgentService.exe process in Network Security

ASA5516-X: Usefulness of the AgentService.exe process

jds5 — Mon, 11 Oct 2021 12:01:26 GMT

Hello,

One of our servers has this executable:
\Cisco Systems, Inc\Cisco Firepower User Agent for Active Directory\AgentService.exe

-What is the use of this process?
-Why does it do exec RPC on remote machines?
-If we remove it what is the impact on our firepower?

Plateforme ASA5516-X

ASA Version 9.8(4)22

Thank you,

BR,

José

Re: ASA5516-X: Usefulness of the AgentService.exe process

Marvin Rhoads — Mon, 11 Oct 2021 13:13:15 GMT

Firepower User Agent is a program that runs on a computer in your domain and synchronizes AD logon and logoff events on configured DCs to a local SQL Express database which is in turn synchronized up the the configured FMC.

It serves to inform FMC of username - IP address mapping for use in both event analysis and policies.

Re: ASA5516-X: Usefulness of the AgentService.exe process

jds5 — Mon, 11 Oct 2021 14:32:36 GMT

Thank you for these precisions.

Is it true that this agent is no longer being maintained?
What will be the solution to replace it

Re: ASA5516-X: Usefulness of the AgentService.exe process

Marvin Rhoads — Mon, 11 Oct 2021 20:07:40 GMT

Yes- User Agent is deprecated.

Firepower 6.7 will not allow you to add User Agent as an identity source.

7.0 will not allow you to upgrade from an earlier version until you remove it.

The replacement is Cisco ISE (or the stripped down ISE-PIC if you only need ISE for Identity). If you have a hardware FMC, you are eligible for a free ISE-PIC license. Otherwise you have to purchase it if you want to continue using identity integration with your FMC.

Re: ASA5516-X: Usefulness of the AgentService.exe process

jds5 — Thu, 21 Oct 2021 15:51:59 GMT

After the audit of our network, we notice that the machine on which the AgentService.exe process is installed launches RPC executions on all the machines in our domain.
Is this normal behavior?

How to allow only one connection between the firepower and our AD?
What will be the impact if we remove the user agent?

Re: ASA5516-X: Usefulness of the AgentService.exe process

Marvin Rhoads — Fri, 22 Oct 2021 03:33:06 GMT

The host running the Cisco Firepower User Agent should only be accessing the configured domain controllers from which it retrieves logon/logoff events in order to gather a mapping of usernames to IP addresses. It writes them to a local SQL Express database which is in turn synced with the configured FMC(s).