topic Firepower 6.2 / Identity Policy with authentication rules required in Network Security

Firepower 6.2 / Identity Policy with authentication rules required

Tue, 12 Mar 2019 13:24:16 GMT

Hello everyone!

I've got a Firepower v6.2 and I'm trying to configure ACLs including filtering by users. I managed to integrate the Firepower with Active Directory, that is I can download users and groups succesfully.

I've already configured an Identity Policy included in the Standard Rules. The authentication is passive. However, when I'm trying to add an ACL in the users tab, there is a warning saying "Identity Policy with authentication rules required" and I can't add users to the ACL.

Any thoughts?.

Cheers,

Fernanda

Have you setup a Cisco User

Marvin Rhoads — Fri, 19 May 2017 05:06:13 GMT

Have you setup a Cisco User Agent in your domain (or have an alternate source of user to IP mapping like ISE/ISE-PIC available)?

http://www.cisco.com/c/en/us/td/docs/security/firepower/621/configuration/guide/fpmc-config-guide-v621/user_identity_sources.html#ID-2225-00000063

Hello Marvin

Fri, 19 May 2017 14:19:34 GMT

Hello Marvin

Thanks for replying. Yes, I already did so. I've got a Cisco User Agent in my domain and the integration is correct. In fact, the users and groups were downloaded succesfully and it can be seen in the Task tab. I think the issue is that the Identify Policy has not been applied correctly. That's why when creating an ACL, the Firepower is not seeing the configured policy.

Regards,

Fernanda

That may well be the case.

Marvin Rhoads — Fri, 19 May 2017 15:00:41 GMT

That may well be the case. Once you have created an Identity Policy you must explicitly reference it in your Access Control Policy.

Here's where you do that:

Great!. It worked!.

Fri, 19 May 2017 19:50:26 GMT

Great!. It worked!.

Many thanks.

You're welcome.

Marvin Rhoads — Sat, 20 May 2017 03:48:29 GMT

You're welcome.

Thanks for letting us know it's resolved and for the rating.

Re: That may well be the case.

InTheJuniverse — Fri, 21 Dec 2018 14:24:53 GMT

Marvin, I follow your posts very closely and they are almost always precise.

Thank you.