topic ISE-PIC to Passive Identity Agent Migration in Network Security

ISE-PIC to Passive Identity Agent Migration

jmeetze — Fri, 22 Aug 2025 12:46:52 GMT

We currently use ISE-PIC as our identity source for identity based policies in our FMC. According to the following EOL notice, ISE-PIC support will end November 30, 2027.

https://www.cisco.com/c/en/us/products/collateral/security/ise-passive-identity-connector/ise-pic-eol.html

Migration options are to upgrade to ISE Advantage or migrate to Passive Identity Agent which was introduced in 7.6 software versions. I'm leaning more towards the Passive Identity Agent, but curious if anyone has gone through this migration yet and what their experience is. We've had no issues with our ISE-PIC as our identity source and our identity rules have worked very well. I just wanted to see if anyone in the community is using the Passive Identity Agent and if it works well for your identity rules.

Thank you.

Re: ISE-PIC to Passive Identity Agent Migration

Marvin Rhoads — Mon, 25 Aug 2025 16:43:55 GMT

Passive identity agent works fine. I have used it personally as have a couple of my customers.

Re: ISE-PIC to Passive Identity Agent Migration

crusier2015 — Tue, 14 Apr 2026 23:05:03 GMT

Hi Marvin

I have problems to this new agent identify logoff sessions of users on their workstations, if i understood correctly it is not work like old agent version(FUA 2.4 that worked until FTD/FMC 6.6) that query workstation by WMI periodicly to check status, this new Passive Identity Agent itself relies on the Kerberos ticketing system to understand user sessions, but the problem is that events logoffs will not appears on Kerberos ids. In my enviroment only appears logoffs events of user when timeout session configured on FMC is hit .
In your customers how this behavior about monitored logoff session on workstations works well as old agent version?
Tks