Firepower UNKNOWN User

[BB34]

I am running software version 6.2.3.6 of Firepower and version 2.3.10 of the firepower user agent.  What I am seeing is for some users the initiator user is showing up as UNKNOWN when querying a user under connection events.  If I go under Host-->Host attributes, the machine ip/name is correct and the correct user is specified.  Last week one of the users had somebody else's ip address, giving them full access to the internet when they shouldn't of had it.  I did an export of the user ip mapping from the firepower agent tool on our DC, and the name and ip look fine.  Very strange issue.  I see there was a bug regarding the shortname and FQDN within the user agent and Realm config, but I am not sure that will solve the problem.  The system is being updated with new AD users when they are created.  This isn't all users as I mentioned.  Any help is much appreciated.

[nspasov]

Hi there-

I would recommend:

1. Reach out to Cisco TAC and have them tshoot the issue

2. Upgrade your deployment to a recommended release (6.2.3.13 or 6.4.0.4) as there several defects that have been resolved since the version that you are currently running

Let us know what the outcome is.

Thank you for rating helpful posts!