FTD Identity Source

[Eric Z]

FTD 2130 in production.  Right now all I see in connection events is ip addresses.  I would like to see computers and usernames.  We don't own ISE.  Is there an alternate way of creating an Identity Source that doesn't require buying another cisco product?  I would like it to use AD to get all IP/Computer/User information.

[Rob Ingram]

@Eric Z you need to learn the IP/username (computer name) bindings from somewhere, either via passive (ISE, ISE-PIC or TS agent) or active authentication (Captive Portal, RAVPN or Traffic Detection). https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/identity-overview.html

I don't know of a way you can learn the identity bindings via another non-cisco means. The best way of learning these bindings is via passive authentication such as ISE, but you could consider ISE-PIC which is a lot cheaper (and less features), this will just gather user identities and IP addresses from AD and share with the subscribers (FMC). https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/pic_admin_guide/pic_admin31/pic_admin31_chapter_00.html