FirePower 6.0, Initiator User showing up as "No Authenticaton Required".

[Karl_F]

I'm Running ASA5515 (9.4-2) with FP module 6.0.0 1005. FSMC 6.0.0 1005.

Under Analysis-Connections-Events-Table View of Connection Events-Initiator User  I am seeing "No Authentication Required" and not the user that should be mapped to the IP address. 

I have active directory integration configured via a Realm, which connects and sees users and allows me to download groups etc, I have an identity policy created using Passive Authentication, and added to the access control policy. I have the User Agent installed on a member server that is polling 2 DC's fine. however still no joy. 

Anyone seeing similar issues? Bug?

Thanks,

Karl.

[JRDIAZ758]

so change mydomain.local to just mydomain????

[Christopher Bell]

Have the same problem, I have an open TAC case on this issue.  When I check Analysis -> Users ->User Activity the user to IP mappings are there.  When trying to view connection events under table view, I get "unknown" for Initiator IP.  I have the realm on my DC set to our domain name to match the AD agent.  I've tried with both the short name and the domain name and the results were the same.   

[tfellinger]

Hi Cristopher,

did you ever resolve this successfully? What was the conclusion after the TAC Case?

Thx!

[Christopher Bell]

The realm had to match between FMC and the LDAP connectors.  There was an issue with using the actual domain name vs. the short name.  So, if our domain was ourdomain.com we had to use the short name:  ourdomain-domain instead.  At least that's worked for us, hope it helps you!

[scott.mickelsonAMS]

Can you please explain where the FMC and LDAP settings were made? I'm having a hard time finding the location in settings.

[Christopher Bell]

Sure, log in FMC.  Go to System (right hand corner), then Integration.  Click the "Realms" tab. 

[bkastor]

Just a heads up to anyone running 6.2.0.2-51... this still isn't fixed. I just opened up a case with TAC and the next day I stumbled on this thread. As soon as I removed the src/dst on the Identity Policy, it worked. I did not have this bug (or maybe the bug needs to be expanded to include "anything" in the src/dst?):

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuz09515/?referring_site=bugquickviewredir

...I had a very defined set of networks (not any of the defaults, as described in this bug). It didn't seem to matter, though. As soon as I remove the src/dst and redeployed, I was able to log into a machine and see my AD username... 

Thanks to everyone contributing to this thread.. this is a monster to configure, so every comment helps!

[er.ankitsharma]

Hello,

After deploying Anyconnect VPN and successfully allowing the Anyconect IP Pool to access the internal network resource, now I am facing challenges to deploy a internet policy for these Anyconnect VPN user.

I want to restrict the Anyconnect users going out on the internet using a AD username based policy.

When I create a outside to outside policy keeping the source as the Anyconnect VPN pool and destination as any with defined AD users and applications like outlook then this policy doesn't hit.

It seems that the FTD is not able to check the AD users added to the policy for Anyconnect policy. It shows 'initiator user' as no authentication required in the connection events.

The rest of the inside to outside policies based on AD username, are working perfectly fine !

Please let me know your views on this.

[mimran@gbmme.com]

Hi Ankit,

Were you able to fix the issue, you facing?

If yes, then what was the fix, I am having similar issue with 6.3.0.