User-to-IP mapping on FMC

[Turbo727]

We have FTD-A as a VPN firewall that authenticates remote users against LDAP and assigns IP addresses.

What we are trying to achieve is a user-based policy applied on FTD-B, but we are having problems identifying users when they are connected to VPN. 

What is the best way to push User-to-IP mapping from FTD-A to FTD-B? Both are managed by the same FMC.

[Chakshu Piplani]

Are your FTD-A and B in HA?

[Turbo727]

No. They are different firewalls.

[Chakshu Piplani]

I dont think that's a possibility as they are treated as separate device.

[Milos_Jovanovic]

Hi @Turbo727,

You won't be able to do this, without intermediate device.

What you need in between is ISE for this purpose. For VPN use-case, it would serve as RADIUS server, responsible for authentication and authorization, while collecting User-to-IP mapping at the same time. For FTD-B use-case, it would serve as identity source (role called Passive Identity, please see more here).

BR,

Milos