Cisco Cisco Firepower Management Center 4000

Click 

.

The Create User Awareness Authentication Object page appears.

Type a 

 and 

 for the object.

Select the LDAP 

. 

If you want to perform user control, you must use a Microsoft Active Directory server. If you use any 
other type of LDAP server, you are limited to retrieving metadata for some users whose activity was 
detected directly by managed devices (as opposed to by User Agents).

User Agents cannot transmit Active Directory user names ending with the 

$

 character to the 

Defense Center. If your Active Directory server contains such user names, you must edit those 
names to remove the final 

$

 character if you want to monitor them.

Specify an 

 or 

 for a primary and, optionally, a backup LDAP server.

Specify the 

 that your LDAP servers use for authentication traffic.

Specify the 

 for the LDAP directory you want to access.

For example, to authenticate names in the Security organization at the Example company, type 

ou=security,dc=example,dc=com

.

To fetch a list of all available domains, click 

 and select the appropriate base distinguished name 

from the drop-down list.

Specify the distinguished 

 and 

 that you want to use to validate access to the LDAP 

directory. Confirm the password.

For example, if you are connecting to an OpenLDAP server where user objects have a 

uid

 attribute and 

the object for the administrator in the Security division at our example company has a 

uid

 value of 

NetworkAdmin

, you would type 

uid=NetworkAdmin,ou=security,dc=example,dc=com.

Choose an 

 method. If you are using encryption, you can add an 

.

The host name in the certificate must match the host name of the LDAP server you specified in step 

Specify the 

 period (in seconds) timeout period after which attempts to contact an unresponsive 

primary LDAP server roll over to the backup connection.

Optionally, before you specify user awareness settings for the object, test the connection by clicking 

.

You have two options, depending on the type of LDAP server you selected in step 

If you are connecting to an Active Directory server, you can enable 

 to specify users to use in access control. Continue with the next step.

If you are connecting to any other kind of server, or do not want to perform user control, skip to step 

.

Click 

 to populate the available groups list using the LDAP parameters you provided.

Specify the users you want to use in access control by using the right and left arrow buttons to include 
and exclude groups.

Including a group automatically includes all of that group’s members, including members of any 
sub-groups. However, if you want to use the sub-group in access control rules, you must explicitly 
include the sub-group. Excluding a group excludes all the members of that group, even if the users are 
members of an included group.