ISE cannot sent TS port range to FMC

[csco11552159]

i got TS agent working with ISE 2.2 .

on ISE 2.2, I can see the User ID, IP and Port range mapping in live session table.

But on FMC, it doesnt show these information.

If i use TS agent directly sent to FMC, it will work.

Is this some kind of  bug between ISE and FMC?

Because TS agent only allow to send mapping to 2 servers, if we need to see all user identity information on ISE and also works on FMC, so we have to send to both ISE and FMC, we will lose redundancy.

it doesnt make sense.

[hslai]

I think it might be expected at present. I will check with our teams.

[csco11552159]

Thank you.

and on FMC, in this way will only keep the last user login.

[hslai]

Some info from our PM indicated that our teams are still working on this to make it more consumable.

[jeppich · Accepted solution]

Hey Chao,

Hsing-Tsu is correct, this is expected behavior.  Please see: https://www.cisco.com/c/en/us/td/docs/security/firepower/620/configuration/guide/fpmc-config-guide-v62/user_identity_sources.html

"If the TS Agent monitors the same users as another passive authentication identity source (the User Agent or ISE), the Firepower Management Center prioritizes the TS Agent data. If the TS Agent and a passive identity source report activity by the same IP address, only the TS Agent data is logged to the Firepower Management Center"

Thanks,

John

jeppich@cisco.com

[csco11552159]

hi John & Hsing-Tsu,

So in order FMC to have correct User ID, port and IP mapping, TS-Agent directly send to FMC? like this:

TS-Agent--->FMC

ISE---(pxgrid)--->FMC

the way we try to do is : 

TS-Agent--->ISE ----(pxgrid)--->FMC.

We can use TS-Agent to send mapping to ISE, then we should easily send all ID mapping to FMC via pxgrid including regular mapping and TS ports mapping. this more make sense.

Will this way work?

[hslai]

Unfortunately it's not quite there yet.

I would suggest you to use TS-Agent => FMC for now, while the solution is still being evolved and developed for the other route.

[csco11552159]

thank you.

i will send to FMC for now. hopefully some changes coming soon.