IP User Mapping - FMC/FTD Identity Policy

[Fantas]

Hi,

I have integrated FMC with ISE PIC and AD through Realm but looks passive authentication is not working as expected.

So I can access URLs If I dont add user group in my ACP but I its not working if I add AD user group in my ACP.

In terms of configurations of ISE PIC and Integration with AD and FMC is perfectly ok and Looks good.

I have doubt that FMC is not sending IP to User mappings to FTD so the rules are not being processed and I cant access URLs.

Any help will be highly appreciated please

[Rob Ingram]

Hi,

Have a look at the verification section in this guide, this will help you determine whether you have the User/IP bindings on the FTD.

HTH

[Fantas]

Thanks,

Look like FMC is not transferring IP to User mapping down to FTD as I cant see my User ID on FTD while its present on FMC.

How I can fix if IP to user mappings are not received by FTD.

[Rob Ingram]

On the FMC go System > Integration > Identity Sources and test the Identity source for ISE is working correctly. If not, refer to this guide to setup FMC and ISE integration.

[Fantas]

ISE and FMC Integration is perfectly fine and working.

But still IP to user mapping not handed over to FTD

[Rob Ingram]

If the bindings are on the FMC, have you defined an identity policy and applied to the FTD?

[Fantas]

Hi,

Yes I have defined Identity and Firewall policies (ACP) and applied to FTD.

For IP to user mapping to FTD, Is there any specific config I am missing.

[Marvin Rhoads]

If you've followed the excellent earlier-referenced blog for identity integration and confirmed everything down to the point of checking actual mappings from the cli and finding none, then you are likely hitting some bug or issue specific to your configuration that is best worked out with the TAC online.

I'd suggest opening a case so that an engineer can work with you directly.

[Fantas]

Thanks,

Yes I am opening case with Cisco for detailed step by step verification's and fix.

[Herald Sison]

hi sir, is this fixed already? i have the same problem to FTD and FMC user mapping are note insynced. any script that i need to run?