Firepower Management Center User Agent

[keithcclark71]

Is the User Agent still an option to use in FMC version  7.2.0 ?  I thought I read somewhere that it was being depreciated in favor of ISE but I really only need the user agent and hope CIsco hasn't done away with it.

[Sheraz.Salim]

Its gone EOL you can use cisco ISE PIC. i think its supported on version 6.6. and on ward version 7.X its not supported anymore.

Firepower User Identity: Migrating from User Agent to Identity Services Engine 

End-of-Life and End-of-Support for the Cisco Firepower User Agent 

Cisco Firepower User Agent will continue to function with the Cisco Firepower Management Center up to and including version 6.6. However, you will see the following warning message in 6.6 when attempting to add a new User Agent.

[keithcclark71]

Is Cisco ISE PIC free? Does it allow username mappings to the logs like the cisco user agent did?

[Sheraz.Salim]

@keithcclark71 If you have cisco smart license you can download it from software download. I am not sure if its free. If I remember its not free.

It does (ISE-PIC) allow the mapping similar to user agent.

[keithcclark71]

I guess ill just never move off of 6.6 version then as I can use the user agent there. I'm seeing $5000 of a Cisco ISE PIC license thats crazy. The business i am setting up firepower is small only 70-80 users and $5 grand for that is ridiculous 

[Sheraz.Salim]

Verion 6.6 in in life support so yes. you can plan it in future.

[Sheraz.Salim · Accepted solution]

Actually just to mention here

Note that per the bulletin in the original posting, ISE-PIC is NOT free if you have the 2-, 5- or 10-device FMCv license. For all other FMC types it is free

[Rob Ingram]

@keithcclark71 

Customers with a physical or virtual (FMCv25, FMCv300) Firepower Management Center appliance as mentioned in Table 1 with active support contracts will be eligible to receive Cisco ISE-PIC at no additional cost.

Refer to table 1 https://www.cisco.com/c/en/us/products/collateral/security/firesight-management-center/bulletin-c25-744508.html

[keithcclark71]

This is not at you Rob but this entire process with Cisco is ridiculous. Thank god I looked into user agent not being available in FMC 7.2 as I would have spent all that time with getting the virtual appliance up and running and then who knows how long i would of been configuring Firepower itself before I came around to do the User Agent only to find out its no longer supported and then having to go to the small business owner saying oops my bad you need to buy this Cisco ISE-PIC for 5 grand. WTF I am so tired of investing my time as an engineer which I have invested hundreds upon hundreds of hours in Cisco only to be bamboozled and to get anything procured with Cisco i'd rather smash my head into concrete. Just a vent here and I guess i am going to just download 6.5 and never upgrade this customer and if the time comes where its being forced i'll put in netgates

[Marvin Rhoads]

FYI, ISE-PIC does not cost US$5,000. The list price for R-ISE-PIC-VM-K9= (ISE Passive Identity Connector Virtual Machine 3000 sessions) is US$1337.50 and the optional support is $257.00 for a one year term. Factoring in normally available discounts means the net cost should be just under $US1,000.00.

While it's not a trivial amount, most business with as few users as the one you cite do not use user identity in their Access Control Policies and thus do not require ISE-PIC (or ISE) as an integration.

[keithcclark71]

Thanks Marvin that 5K number came up on a search so my source obviously bad. I am putting in Firepower for a local pharmacy with 4 Sites all small in scope so doing FTD 1010's to all and hoping I haven't under scoped the project as I will be doing IPSEC tunnels and hairpinning the VPN  in some instances. As for Anyconnect VPN i'm planning to deploy using start before login with security card 2FA authentication.  I have deployed firepower with single FTD 1010 at a local manufacturer under NIST 800-171 compliance so I try to leverage the user-ip mapping per the NIST control framework requirements. I was hoping I could move forward with pharmacy project to deploy 7.2 but I guess I will have to roll out 6.6.5 so I can retain the user agent and possibly go the upgrade route in the future to ISE-PIC.  That being stated if you have anything that I should be aware of here I'd appreciate any feedback you can inject. Lastly what is the level of difficulty in upgrading to ISE-PIC from a 6.6.5 image, is this a difficult upgrade path to 7.2 and is ISE-PIC a steep learning curve compared to the user-agent which was very easy to setup. Thanks again Marvin I appreciate your insight over the years as you have helped me get through many confused times.

[Marvin Rhoads · Accepted solution]

You're welcome @keithcclark71 

ISE-PIC is a separate VM installation. It's pretty simple to setup - no more than a couple of hours including deploying the VM from ova file. Do note the VM requirements though. In a small environment there's often not the same available memory and compute resources we are used to in a larger enterprise. Once it's running integrating it into FMC is also simple of you follow any of the available guides (Cisco doc or youtube demos).

[keithcclark71]

Thanks Marvin. 

[imanv]

Just for updating this post for future search ....

At this page you can find the " Grant Minimum Permission to an Active Directory User Account Used by the Sourcefire User Agent "

https://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/118637-configure-firesight-00.html 

Note that Firepower User Agent will not supported by FMC version7. The FMC Version 6.6.0/6.6.x is the last release to support the Cisco Firepower User Agent software as an identity source. You should switch to Cisco Identity Services Engine/Passive Identity Connector (ISE/ISE-PIC)

Best Regards.