topic Re: User Monitoring with AD on Firepower in Network Security

User Monitoring with AD on Firepower

00u18jg7x27DHjRMh5d7 — Fri, 24 Jun 2022 20:00:30 GMT

I have been attempting to set up user monitoring on our Cisco Firepower device so we can see usernames instead of IP addresses under monitoring. It works with the VPN connection but not for internal traffic. What could I be overlooking or does this require additional features? It seems straight forward I added an Identity rule Active Auth with NTLM type, placed a user available on an inside to outside rule both facing the Windows AD server that allows connections to VPN.

Thanks

Re: User Monitoring with AD on Firepower

Rob Ingram — Fri, 24 Jun 2022 20:10:19 GMT

@00u18jg7x27DHjRMh5d7 sounds like you intend to do active authentication using a captive portal? Have you've created a Realm, identity policy and referenced the identity policy in the Access Control Policy?

Re: User Monitoring with AD on Firepower

00u18jg7x27DHjRMh5d7 — Fri, 24 Jun 2022 20:23:43 GMT

I have created the ID Realm it is how VPN users confirm ID when logging in. Maybe I am referencing it incorrectly but in ACL I selected under the Users Tab the server, logging beginning and end of connection.

Re: User Monitoring with AD on Firepower

Rob Ingram — Fri, 24 Jun 2022 20:37:45 GMT

@00u18jg7x27DHjRMh5d7 here is the guide https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/control_users_with_captive_portal.html that has all the steps to configure.

Do you have ISE or ISE-PIC, this uses passive authentication and more transparent and would not require the user to actively authenticate.

Re: User Monitoring with AD on Firepower

00u18jg7x27DHjRMh5d7 — Fri, 24 Jun 2022 20:48:50 GMT

I unfortunately do not have ISE for the time being.

Re: User Monitoring with AD on Firepower

00u18jg7x27DHjRMh5d7 — Fri, 05 Aug 2022 19:27:55 GMT

Rob,

So I am trying to set up ISE with our firepower but having problems with joining the Firepower device. We keep encountering certificate errors. Does it matter if the cert comes from ISE or FTD device? Also is FMC required to join ISE?

I already have ISE joined to the AD just trying to join the FTD now so we can test.

Thanks

Re: User Monitoring with AD on Firepower

Rob Ingram — Sat, 06 Aug 2022 06:59:32 GMT

@00u18jg7x27DHjRMh5d7 no it doesn't matter where the certificates come from, as long as both ISE and FMC trust the certificates. Commonly you would use either ISE CA to sign the pxGrid certificiates or an internal CA (Windows) - example here

Re: User Monitoring with AD on Firepower

00u18jg7x27DHjRMh5d7 — Mon, 08 Aug 2022 12:51:44 GMT

That is what I thought but having an issue when joining FP to ISE keeps erroring / rejecting the cert for some reason. Will give it another attempt today.

Thank