Showing results for 
Search instead for 
Did you mean: 

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

Cisco Employee

ISE PassiveID User-IP Mapping timeout



Working on a use case as follows:

UserA - (First Login)

UserA - (Second Login)

UserA login into after login at Based on ISE passiveID, only first IP is registered in User-IP mapping and shared via pxGrid to FMC. Any possibility for the same UserA map to multiple IPs for concurrent login?

Currently even based on endpoint probes, the mapping will not get updated within 4 hours if user has no logout from earlier session.

Without relying on limiting concurrent login at AD and PAM solution, do we have any workaround for ISE PassiveID to get latest endpoint information? Or are there any possibility for same username mapped to 2 or more IP?



Wing Churn 

VIP Advisor


I am using this with FMC configured with passive authentication identity
policy pointing to AD realm. Basically my users login to network either
with dot1x for LAN/WLAN or ISE authorization for VPN. Once logged in, ISE
updates FMC using PxGrid. Then FMC updates user-ip mapping DB and contact
AD to obtain AD groups as well.

It can support multiple IPs for same user and I can see this update in FTD
DB by running the script

Here is an example:

root@lab-firepower:/home/admin# -u mohammed.baqari

WARNING: This script was not tested on this major version (6.5.0)! The
results may be unexpected.
Current Time: 08/25/2020 15:33:27 UTC

Getting information on username(s)...
User #1: mohammed.baqari

ID: 2981
Last Seen: Unknown
for_policy: 0
Realm ID: 5

| Database |

##) IP Address [Realm ID]
1) ::ffff: [5]
2) ::ffff: [5]

##) Group Name (ID)
1) Domain Users (3)

**** please remember to rate useful posts

Our problem is more towards ISE-PIC. PassiveID does not reflect new IP for new login with another IP address.

If userA login from for the first time, we receive the login message in ISE-PIC and share across to FMC via pxGrid. A second login from userA without logout from previous session at another IP address does not appear in ISE-PIC. Are there any specific tuning in ISE-PIC for concurrent/multi IP mapping?


Wing Churn


You can tune the global timeout value for the session directory but that is about all. Sadly, it won't solve the issue you are experiencing. If you moved to ISE instead of PIC, you would get the benefit of RADIUS accounting.

Content for Community-Ad