From what you were saying I would think you are working for an integrator so I would guess your local Cisco SE should be able to help you out with this if anything i unclear.
I will try to answer some of your questions, but some of them are about hard limits which are mostly not documented and you will need Cisco to provide more detailed information and proper guidelines.
1. Maximum Number of AD Servers Supported in FTD ?
If you are using the User Agent, each User Agent can poll max. 5x AD servers for login events. If you need to scale this out further you will need additional agents. Source: CSCvb26089
2. Can we Integrate Existing Syslog with FTD for Identity Based Policy ?
What do you mean by integration? Parsing a random syslog stream for identity mappings? If yes, no that is not supported
3. Can we Integrate Citrix Xenapp with FTD for Identity Based Policy ?
Yes. You can use the Terminal Server Agent starting with version 6.2. This works by assigning each user on the terminal server a unique source port range to a user can be mapped to <ipaddress>:<source-port-range>
4. Can we Integrate Third Party Authorization Server with FTD for Identity based policy ?
If you are using Active Authentication (Captive Portal) you can use Kerberos to authenticate
5. Can the access be allowed/deny based on the device that the user used for previous login?
That sounds like a very weird requirement. If I understand this correctly you want to know if we can block/permit traffic for ip addresses which a user has had before - No.
6. Identity firewall solution for non domain devices,including personal mobile devices ?
Captive Portal, but tbh ISE integration is the way to go for this. Guest access via WLAN controller to get identity into ISE and publish to FMC via pxGRID (alternative to User Agent, Cisco ISE required!)
7. Maximum User to IP Mapping Supported on FTD 9300 Appliance?
I am not aware of any hard limits. If you got a large scale deployment you should definetly reach out to Cisco for guidance. Believe me you will do it either way if you encounter issues later on. I have pushed around 4k mappings to a SM-24 module so far without issues
8. Maximum User-groups supported on FTD 9300 Appliance?
I am not aware of any hard limits. If you got a large scale deployment you should definetly reach out to Cisco for guidance. I have had no issues with testing of 4k groups and 12k users but dont do this in production. Keep in mind that AD will only report a max of 1500 users in one group due to a flag set on the windows server. If you need to increase this value a config change on the windows side is required. Details: CSCva06227
9 How Many IP addresses a user identity can be mapped against?
I am not aware of any hard limits. If you got a large scale deployment you should definetly reach out to Cisco for guidance.
10 Can the timer be set per server (Different for AD and syslog) ?
Since you cant provide indentity integration with Syslog there are no different timers. You may set the global timeout for identity mappings to expire after a period of time
11 In case of fail-over to standby device, is the user-ip and user-group database synchronisation achieved, including other run time information ?
User to ip mappings are always synced to both firewalls from FMC so you should not have any state related issues with user identity. If you want to know which feature is synced to which degree you might wanna check out the FMC 6.2 config guide for further information.
12 Can segregation be performed based on the access from domain and non-domain devices (i.e. differential user access levels from domain and non-domain devices) ?
Yes. One rule using identity group and one rule without identity group. :)
13 Capability to extend the user identification policies to personal mobile devices?
If your mobile device can trigger a logon event in AD thats possible. ISE would be another option.
14 If single user login through multiple devices (including domain, non-domain and mobile), how will identity FW react to this ?
There is only a difference between passive and active authentication. As a general rule of thumb the same user can login to multiple devices (1:n relation between user and device) and policy can be enforced for each device without issues. Multiple users to one ip address is only supported using Terminal Server Agent.
15 Support for client IP probing and configurability of the probe timing?
FMC can probe clients to fill its host profiles but what exactly do you mean by probing and for what information?
16 Integration with Mcafee SIEM, any open source SIEM, Nessus Vulnerability Scanner.?
You can always push your events using either E-Streamer or syslog to your logging server. Logpoint & Splunk integration is working out of the box. (Logpoint due to a recent project, so not sure if its publicly available yet)
After going through all of this I have to say this sounds like a list from a bidding. If thats indeed the case please engage cisco presales support for partners who will be happy to help you out
