cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Sourcefire 6.0 / FireSIGHT MC 6.0 - Users Not Populating

Keith Joel
Beginner
Beginner

Edit: moved to Sourcefire category.

---

Hi All,

Wondering if somebody can lead me in the right direction here, I have a customer running Sourcefire 6.0 with the FireSIGHT MC and am having an issue with the IP to User mapping.  Under Analysis > Users > Users I don't have any records.  I've gone in and setup the "realm" under itnegration which tests out ok, and setup the user download which pulls down the groups so I know the linkage for the "realm" is there.  The tasks show LDAP synch with 2 groups and 293 Users successful.  Identity Policy was setup with passive authentication and the User Agent on the active directory system is installed and tested successfully.  I noticed the following in the syslogs stored locally (changed hostname and users) and I'm wondering if it has something to do with it?

Feb 02 2016 12:31:36 HOSTNAME SF-IMS[30127]: [30170] SFDataCorrelator:UserIdentity [WARN] Unable to find realm for user user1, domain XX
Feb 02 2016 12:31:35 HOSTNAME SF-IMS[30127]: [30172] SFDataCorrelator:UserIdentity [WARN] Unable to find realm for user user2, domain XX

Any other information required let me know.

Thanks,

Keith

1 ACCEPTED SOLUTION

Accepted Solutions

Aastha Bhardwaj
Cisco Employee
Cisco Employee

Hi,

Check this : https://tools.cisco.com/bugsearch/bug/CSCux39125/?reffering_site=dumpcr

To get users correctly associating with their IP addresses, the fix is to change the "AD Primary Domain" field in the Realm configuration to the short name of the domain. This name is visible in the message found in /var/log/messages .

After changing this field, save the realm configuration and  make sure that user download continues to work as expected. 

 

Regards,

Aastha Bhardwaj

Rate if that helps!!!

View solution in original post

4 REPLIES 4

Aastha Bhardwaj
Cisco Employee
Cisco Employee

Hi,

Check this : https://tools.cisco.com/bugsearch/bug/CSCux39125/?reffering_site=dumpcr

To get users correctly associating with their IP addresses, the fix is to change the "AD Primary Domain" field in the Realm configuration to the short name of the domain. This name is visible in the message found in /var/log/messages .

After changing this field, save the realm configuration and  make sure that user download continues to work as expected. 

 

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Bingo.  That did it, thanks so much.  

Given the bug is resolved in a future update, will the domain need to be changed back from the short name?

Hi,

Yes later if you upgrade the FMC to the version on which it is resolved you should be able to change the name back to what it was originally.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Jarvis IT
Beginner
Beginner

Thankfully I stumbled across this today, I have had a SR open for a couple of weeks now after integrating ISE v1.4 and Source fire v6.0 through PXGrid. Once I changed this I started to see the users populate with a realm! Thank you!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: