Hello everyone!
Thank you in advanced for reading!
We have a NGFW with a sensor running version 6.2 that presents with a problem, seemingly at random. The FW, is configured to authenticate AD users using the CISCO Agent, installed on a server which has links to both our primary and backup controllers. All is working on the agent side, it has the correct mapping, ip address, refreshes as expected, etc.
We've had instances where the user can NOT browse, the sensor shows an "unknown" user (although shows in the events as "allowed"), but the FW does not prompt for credentials to the client, nor refreshes or sees the mapping in question; internet explorer keeps spinning. However, by logging on as someone else, it starts working fine with that other users' credentials, without prompting; it just goes.
How can this be tracked? How to know what the problem is, or where it resides? .... Changing IP addresses does not solve it, resetting the password of the original user with the problem does not solve it... I'm confused as to where to look and what can be causing this.
Thank you and have a great day!
