topic The identity firewall is in Network Security

ASA "AD Integration" - where to start

PAUL TRIVINO — Tue, 12 Mar 2019 05:14:53 GMT

I have been tasked with getting so that our ASA rules have visibility to what user is hitting a rule (not necessarily to enforce rules that way, yet). I am not sure where to even start this process.

I see the "Identity Options" policiy in CSM, which I am guessing is where to configure this, but I have no idea of the overall process. Anyone have a suggestion as to where to start, and/or if there is an overview document somewhere?

The identity firewall is

Karsten Iwen — Thu, 18 Dec 2014 20:52:23 GMT

The identity firewall is pretty good documented in the config-guide:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/aaa_idfw.html

You need the CDA for the Identity-firewall:

http://www.cisco.com/c/en/us/td/docs/security/ibf/cda_10/Install_Config_guide/cda10.html

Karsten, thanks. Those look

PAUL TRIVINO — Thu, 18 Dec 2014 21:47:17 GMT

Karsten, thanks. Those look like good links (they *work*, for sure...;^) and will be useful. I'll come back and mark this Correct as soon as I read them.

Thanks again.

Karsten, one thing we'll want

PAUL TRIVINO — Fri, 19 Dec 2014 19:12:41 GMT

Karsten, one thing we'll want is to test first, of course - do you happen to know if I can then specify "Any" for User/Group in a rule, and have the UserID and/or Group be in the log messages?

Thanks again.

"any" user or group is the

Karsten Iwen — Fri, 19 Dec 2014 19:20:42 GMT

"any" user or group is the default for all ACEs. When you configure the identity-firewall you don't need to change your rules directly. If the ASA knows the user-mapping, it will show this in the logs.

Excellent, thanks.

PAUL TRIVINO — Fri, 19 Dec 2014 22:31:40 GMT

Excellent, thanks.