FirePower User Agent v2.3 build 10

[Gabrielm1]

My User agent failed a week or so ago and had to move it off of our Domain Controller.

I am currently running Cisco Firepower Management Center for VMWare version 6.2.3.12.  I installed the user agent on a 2012 r2 server.  I have a connection with my Active Directory server and I can see user events in the agent log tab:

[2329] - Real Time Event Received - 5/1/2019 7:54:44 AM,AbcdefG,xxx.xxx.xxx.xxx,interactive

I have configured the IP of the server that is running the agent in the FMC - System - Integration - Identity Sources - User Agent and the FMC Health Monitor is showing green status on the user agent status monitor.

When I add the FMC IP address or the DNS name I get an unavailable status.  I checked the communication between the user agent and the FMC and it shows connectivity via port 3306:

23:11:10.442517 IP xxx.org.50095 > xxx.org.3306: Flags [.], ack 1, win 513, length 0

Looking at the logs from the user agent I get this error:

[2201] - Report login information from xxx.xxx.xxx.xxx to xxx.xxx.xxx.xxx failed after 5/1/2019 7:45:04 AM. [The host xxx.xxx.xxx.xxx does not support SSL connections.].

Is there an SSL configuration on the FMC that I am missing that allows the user agent and FMC to transfer user activity to the FMC?

Has there been a change in the FMC versions that made the Active Directory User Activity require an SSL connection?

Thanks for any assistance regarding this problem.

[Jon Major]

---

@Gabrielm1 wrote:

Yes, it's an internal CA signed by digicert.

You have documentation on how to create the template for the CA to import the cert into the FMC without the contraint error?

---

See my last reply with screenshots.

[Jon Major]

Marvin's absolutely right (as Marvins are want to be). If you're using a Microsoft CA, I normally duplicate the Web Server template, update the compatibility, enable basic constraints, and mark it as critical. No doubt there is another way to do it, but that way seems to work fine. After that (and adding the new template to my CA to be issued) the FMC imports it just fine. Of note, the GUI doesn't seem to generate a CSR that includes SAN names, so I tend to use Digi Cert's CSR generation utility. 

 @Gabrielm1 

[Gabrielm1]

Got it, didn't see the second page of the thread.  Appreciate it...

[Gabrielm1 · Accepted solution]

Thanks for everyone's help.  I was able to Import our latest CA Cert.  Good for 2 years ;)  I've added a work plan I created to rinse and repeat in 2021.

Thanks again