topic Re: Firepower user identity in Network Security

Firepower user identity

ccna_security — Fri, 21 Feb 2020 17:55:36 GMT

Dear all. we use network discovery and it works as expected. But today we faced interesting issue. When i looked at x.x.x.x ip's identity, it shows that current user is TOM, but we are sure that TOM's ip address is y.y.y.y. when we look at y.y.y.y it shows TOM as current user. The question is that why x.x.x.x was not updated? is there any way to update x.x.x.x to see who is currently using computer?

Note: i deleted that ip in network map, and created some noise from that ip but identity still shows Discovered Identity/TOM

Re: Firepower user identity

Rob Ingram — Tue, 18 Feb 2020 08:51:17 GMT

Hi,

The Cisco Live session BRKSEC-3227 covers Firepower User Identity troubleshooting, and may provide some useful commands. Refer to the verification section of this guide for more troubleshooting commands.

HTH

Re: Firepower user identity

ccna_security — Tue, 18 Feb 2020 10:52:58 GMT

Hello RJI

this is my mistake. i found out that computer was not in domain. so it is not connected to LDAP server. when we added computer to domain, firewall was able to identify user who logged in computer. thanks.