cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1375
Views
5
Helpful
2
Replies

Firepower user identity

ccna_security
Level 3
Level 3

Dear all. we use network discovery and it works as expected. But today we faced interesting issue. When i looked at x.x.x.x ip's identity, it shows that current user is TOM, but we are sure that TOM's ip address is y.y.y.y. when we look at y.y.y.y it shows TOM as current user. The question is that why x.x.x.x was not updated? is there any way to update x.x.x.x to see who is currently using computer?

Note: i deleted that ip in network map, and created some noise from that ip but identity still shows Discovered Identity/TOM

2 Replies 2

Hi,

The Cisco Live session BRKSEC-3227 covers Firepower User Identity troubleshooting, and may provide some useful commands. Refer to the verification section of this guide for more troubleshooting commands.

 

 

HTH

Hello RJI

this is my mistake. i found out that computer was not in domain. so it is not connected to LDAP server. when we added computer to domain, firewall was able to identify user who logged in computer. thanks.

Review Cisco Networking for a $25 gift card