topic Secure FMC 7.2x User Authentication Dashboard in Network Security

Secure FMC 7.2x User Authentication Dashboard

davparker — Fri, 12 Apr 2024 21:53:28 GMT

I'm trying to figure out how to display user authentication attempts for VPN success/failures. I can see successful logins but not sure where to go to show failed login attempts. I have configured a Flexconfig Object to not hide username. Just trying to figure out how to show that in Secure FMC.

Thanks,

David

Re: Secure FMC 7.2x User Authentication Dashboard

MHM Cisco World — Fri, 12 Apr 2024 22:19:42 GMT

Try this way

Check message ID (failed auth) and add it to event list

MHM

Re: Secure FMC 7.2x User Authentication Dashboard

Marvin Rhoads — Sat, 13 Apr 2024 03:13:25 GMT

See the VPN Troubleshooting section (under the Device menu). You can filter there to show only failed attempts if so desired.

Re: Secure FMC 7.2x User Authentication Dashboard

davparker — Sun, 14 Apr 2024 02:08:17 GMT

Thanks, that works! It would be nice to add this to a dashboard.

Re: Secure FMC 7.2x User Authentication Dashboard

MHM Cisco World — Sun, 14 Apr 2024 07:19:27 GMT

Solved: Authentication Attempts Logs On FTD FirePOWER 2130 or FTD Cisco ISA 3000 - Cisco Community

did you ever try my suggestion ??

MHM

Re: Secure FMC 7.2x User Authentication Dashboard

Marvin Rhoads — Sun, 14 Apr 2024 12:04:45 GMT

@davparker I'm not sure how to build a dashboard for it, but it's relatively easy to make a report. When you have the troubleshooting page open, just click on reporting and customize it to suit. Here is a filter for rejected users:

You can generate that on-demand or schedule it to run daily etc. and optionally email it to you. Here's an example of what the rpoert PDF looks like (device name redacted):

Re: Secure FMC 7.2x User Authentication Dashboard

davparker — Mon, 15 Apr 2024 13:43:01 GMT

I wasn't sure where in FMC to search.