topic Realms and Identity Sources in Network Security

Realms and Identity Sources

Chess Norris — Tue, 24 Oct 2023 07:11:43 GMT

Hello,

In order to be able to see usernames in the FMC connection event log, would it be enough to add our AD server as a realm and create an identity policy or do we also need to configure an identiy source (like Cisco ISE) for this to work?

Thanks

/Chess

Re: Realms and Identity Sources

Rob Ingram — Tue, 24 Oct 2023 07:26:39 GMT

@Chess Norris If you are using the FTD for Remote Access VPN then the users will be learnt passively (you don't need to specify an ID source). However if you want the usernames for wired/wireless authenticated users to be learnt by the FMC/FTD, then you need to send the IP/Username bindings to the FMC via pxgrid.

Re: Realms and Identity Sources

Chess Norris — Tue, 24 Oct 2023 07:28:50 GMT

Thank you for the confirmation.

/Chess

Re: Realms and Identity Sources

Marvin Rhoads — Tue, 24 Oct 2023 13:58:27 GMT

Adding to what @Rob Ingram correctly noted:

Realm integration tells FMC these are the AD groups and their members for your configured realm.

The ISE identity source maps IP addresses to users. ISE obtains that information via either Active (802.1x) or passive (via PassiveID feature which reads from your DCs' event logs) authentication.

Re: Realms and Identity Sources

Chess Norris — Tue, 24 Oct 2023 16:13:14 GMT

Thanks Marvin!