User Monitoring with AD on Firepower

[00u18jg7x27DHjRMh5d7]

I have been attempting to set up user monitoring on our Cisco Firepower device so we can see usernames instead of IP addresses under monitoring. It works with the VPN connection but not for internal traffic. What could I be overlooking or does this require additional features? It seems straight forward I added an Identity rule Active Auth with NTLM type, placed a user available on an inside to outside rule both facing the Windows AD server that allows connections to VPN.

Thanks   

[Rob Ingram]

@00u18jg7x27DHjRMh5d7 sounds like you intend to do active authentication using a captive portal? Have you've created a Realm, identity policy and referenced the identity policy in the Access Control Policy?

[00u18jg7x27DHjRMh5d7]

I have created the ID Realm it is how VPN users confirm ID when logging in. Maybe I am referencing it incorrectly but in ACL I selected under the Users Tab the server, logging beginning and end of connection. 

[Rob Ingram]

@00u18jg7x27DHjRMh5d7 here is the guide https://www.cisco.com/c/en/us/td/docs/security/firepower/660/configuration/guide/fpmc-config-guide-v66/control_users_with_captive_portal.html that has all the steps to configure.

Do you have ISE or ISE-PIC, this uses passive authentication and more transparent and would not require the user to actively authenticate.

[00u18jg7x27DHjRMh5d7]

I unfortunately do not have ISE for the time being. 

[00u18jg7x27DHjRMh5d7]

Rob,

 So I am trying to set up ISE with our firepower but having problems with joining the Firepower device. We keep encountering certificate errors. Does it matter if the cert comes from ISE or FTD device? Also is FMC required to join ISE?

I already have ISE joined to the AD just trying to join the FTD now so we can test. 

Thanks

[Rob Ingram · Accepted solution]

@00u18jg7x27DHjRMh5d7 no it doesn't matter where the certificates come from, as long as both ISE and FMC trust the certificates. Commonly you would use either ISE CA to sign the pxGrid certificiates or an internal CA (Windows) - example here

[00u18jg7x27DHjRMh5d7]

That is what I thought but having an issue when joining FP to ISE keeps erroring / rejecting the cert for some reason. Will give it another attempt today.

Thank