Cannot see Initiator User in my analysis>connection event

[l.buschi]

Hi all,

my firepower has a working realm and a working user agent.

I can download group and see hosts.

I can't find in my connection event a column with user IP initiator.

Can somebody hel me?

(I configured a rule with passive authentication and it works)

Tks

Johnny

[Raghunath Kulkarni]

Hi,

To begin with i would recommend we check if the user agent is picking the user-ip mapping from the directory.

Step 1: Check if the User logon event is generated on the active directory.

Step 2: 

Could you please login to server where user agent is installed and perform the following.

Go to the Folder where User agent is installed. You will find a Tool.exe file. Run that tool, click on User MAP tab and download all user to ip mappings.

Only when we have the user-ip mapping available the FMC would get the information and then push it to the sensor.