Cisco WSA Transparent User Identification and RDS (Horizon)

[AbdulRasheed66467]

Dear All,

We are not using Cisco ISE or ASA. 

As I understand, the transparent user identification can be done using an Agent (the agent will pass the user-id to IP address mapping to the WSA). 

This is true for VDI users like VMware Horizon where each user will be given a dedicated VM as VDI desktop. Each VM will have its own IP address as well.

But when we use any Terminal Servers (like windows), how can we get the same user-id and IP address mapping. In this case more than one user users having the same IP address -We are not using Cisco ISE or ASA.  

[balaji.bandi]

But when we use any Terminal Servers (like windows), how can we get the same user-id and IP address mapping. In this case more than one user users having the same IP address -We are not using Cisco ISE or ASA.  

This is bit different how it works, there is some Limitation here.  what are you looking to with terminal server login users ?

[AbdulRasheed66467]

Hello Balaji,

I am allowing this users to use hosted web browsers. I need to apply polices in the WSA based on the user logged in to the terminal servers.

[amojarra]

kindly check page 134 : User Guide for AsyncOS 14.0 for Cisco Web Security Appliances - GD (General Deployment)

maybe Persistent Cookie Surrogate or • Session Cookie Surrogate will help you.

Please note that there are some limitations and concerns such as : 

 If you have configured the Identification Profiles to use different authentication surrogates(IPaddress, persistent cookie,session cookie, and so on), then the accessis authenticated using the IPaddresssurrogate even though the access matches Identification Profiles with other surrogates.  

+++++++++++++++++++++++++++++++++++++++++++++++++++

++++   If you find this answer helpful, please rate it as such  ++++

+++++++++++++++++++++++++++++++++++++++++++++++++++