PassiveID integration with ASA

[josh.green]

Hi all,

Just a quick general query, I'm looking at integrating PassiveID into our network (allowing firewall rules based on AD groups instead of IP) 

I can see this is possible via the FMC/FTD deployments but I can't find anything specific online which states we can do this on an ASA. Has anyone had any experience of this before? If so, can you link me to the documentation if possible?

Thanks,

Josh

[Marvin Rhoads · Accepted solution]

Using identity in ASA policies is limited to integration done via some legacy tools (AD Agent). Here's a guide on configuring and using it:

https://community.cisco.com/t5/security-documents/asa-idfw-identity-firewall-step-by-step-configuration/ta-p/3127806

ISE integration (with our without PassiveID) is not supported.

[josh.green]

Thanks Marvin. That link and your additional input is very useful.