cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

171
Views
5
Helpful
2
Replies
Highlighted
Participant

Firepower user identity

Dear all. we use network discovery and it works as expected. But today we faced interesting issue. When i looked at x.x.x.x ip's identity, it shows that current user is TOM, but we are sure that TOM's ip address is y.y.y.y. when we look at y.y.y.y it shows TOM as current user. The question is that why x.x.x.x was not updated? is there any way to update x.x.x.x to see who is currently using computer?

Note: i deleted that ip in network map, and created some noise from that ip but identity still shows Discovered Identity/TOM

2 REPLIES 2
Highlighted
VIP Advisor

Re: Firepower user identity

Hi,

The Cisco Live session BRKSEC-3227 covers Firepower User Identity troubleshooting, and may provide some useful commands. Refer to the verification section of this guide for more troubleshooting commands.

 

 

HTH

Highlighted
Participant

Re: Firepower user identity

Hello RJI

this is my mistake. i found out that computer was not in domain. so it is not connected to LDAP server. when we added computer to domain, firewall was able to identify user who logged in computer. thanks.