ā02-22-2023 06:43 AM
Trying to get this setup and it appears to be successful when I setup the DC's and configure them. This is for FMC in the background to identify users/devices. However, in the dashboard the provider always shows down. After a lot of research it appears due to a number of Microsoft changes the DC's no longer allow this WMI connectivity. I found a number of posts regarding un-installing a patch or putting in a reg key to fix it but it appears that was sunset as well in early/mid 2022. I attempted to deploy the agents as well and those appear to have been successful but it still doesn't appear to work.
Whole goal here is to let FMC/FTD be able to identify users from AD. Works just fine if the user actually authenticated to ISE (dot1x, etc) but if the user is just an AD user logging into a machine and that machine simply logs into the domain and never authenticates to ISE, the mapping in ISE never happens and thus FMC/FTD never learns anything about the device.
Is there anyway to get this working now? I've used the downloadable user agent in the past but according to documentation its being EOL'd too.
Solved! Go to Solution.
ā02-22-2023 07:40 AM
Don't use the WMI-based Passive ID Agent, use the newer EVT-based agent.
Configure EVT-Based Identity Services Engine Passive ID Agent
ā02-22-2023 07:40 AM
Don't use the WMI-based Passive ID Agent, use the newer EVT-based agent.
Configure EVT-Based Identity Services Engine Passive ID Agent
ā02-22-2023 08:50 AM
This was it. I had already deployed the agents but hadn't added the DCs using the agents! Story of my life. One step short of my goal
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide