FirePOWER: ‘No Authentication Required’ No Usernames
KB ID 0001460 Problem When attempting to track Users with FirePOWER, the FMC would not show any usernames? Solution Theres a lot of reasons this might not work, let’s take a look at a few of them. Firstly make sure the server running the ‘user agent’ is listed under System >Integration > Identity Sources > User Agent. It probably goes without saying, but over on server running the user agent, make sure it...
Updating FirePOWER Module (From ASDM)
KB ID 0001348 Problem Normally I don’t like upgrading the SFR this way. But then I tend to install new firewalls set them up and walk away, so its easier (and a LOT quicker) to simply image the module to the latest version and then set it up. Like So; Re-Image and Update the Cisco FirePOWER Services Module This week I had an existing customer, who has an ASA5508-X but wasn’t using his FirePOWER, I’d installed the...
FirePOWER – ‘DataPlaneInterface0’ is not receiving and packets
KB ID 0001344 Problem While replacing a FirePOWER Management console, I got this error; Interface Status Interface ‘DataPlaneInterface0’ is not receiving any packets Solution A look a the health monitor showed me the same thing; Firstly, common sense dictates, that this is a live firewall and traffic is actually flowing though it? In my case the traffic simply needed to be ‘sent though’ the module. Execute...
Cisco FirePOWER User Agent – Use With the FirePOWER Management Console
KB ID 0001179 Problem FirePOWER Management Center, will give you a wealth of information on traffic/threats etc. Usually it will tell you what IP the offenders are on, but if you want to know what a USER is doing, then that means you have to look though logs see who had what IP, at what time etc. So you can install the FirePOWER User Agent on a machine, (this can be a client machine, though I usually put it on a member server). You...
FirePOWER Agent – Real-Time Status ‘Unavailable’
KB ID 0001323 D Problem I was deploying a Cisco FirePOWER user agent last week, but once setup, the agent reported that the Real-Time status for SOME of the domain controllers was permanently ‘Unavailable’. Now I know you have to be patient with these things so I went and had a coffee. Still it refused to ‘go green’. Solution I addition to all the other rights and firewall rules that you normally have to check....
Cisco FirePOWER Management Center Appliance – Allowing Domain Authentication
KB ID 0001117 Problem Once deployed, authentication is handled by the appliances own internal user database, in larger organisations this is a little impractical. So the ability to create an Active Directory Group, and delegate access to Firesight to members of that group is a little more versatile. Solution I’m making the assumption that the appliance does not already have external authentication setup at all, so I’ll...