Firepower via FMC

[shaikh.zaid22]

Hi,

I am experiencing a weird issue with my firewall which is a cisco firepower 2110 via FMC. AD is integrated for remote VPN.

Under the Analysis tab when i try to filter traffic with a particular source ip address say 10.X.X.30, the current user: shows as discovered identities\"name_of_user" (LDAP). However, when i crosscheck the username showing in current user is incorrect.

This am observing only on wirelessLAN.

for Eg: i connected a test laptop with domain credentials on WLAN i get the ip address say 10.X.X.35, however under Current User section: the user information shows is of some other user.

How is it possible? Since on te Firewall only the AD is integrated and reachability is ensured.

Please provide some insight. 

[Marvin Rhoads · Accepted solution]

To get high fidelity username to IP address mapping information you should have an identity integration - either Cisco ISE (preferred) or User Agent (deprecated starting with 6.7).

Otherwise you will get the passive discovery from a network discovery policy. The AD integration as an authentication source for remote access VPN will only apply to VPN users. AD integration as a realm will only pull in AD groups for use in policies (which in turn depends on identity mapping)

[shaikh.zaid22]

Thank you Marvin.

Understood. I have to configure Identity poilicy with ISE to get accurate user info.

It will be great if you can share the link to learn more about this.

Thanks once again.

[Marvin Rhoads]

The FMC configuration guide has a decent explanation of the necessary steps:

https://www.cisco.com/c/en/us/td/docs/security/firepower/70/configuration/guide/fpmc-config-guide-v70/control_users_with_ise_ise_pic.html