Cisco Cisco Firepower Management Center 4000

Admin

On the Create Authentication Object page, click the down arrow next to 

.

The section expands.

Optionally, configure access defaults by group membership.

In the 

 fields that correspond to FireSIGHT System user roles, type the distinguished name for the 

LDAP groups that contain users who should be assigned to those roles.

For example, you might type the following in the

 field to authenticate names in the 

information technology organization at the Example company:

cn=itgroup,ou=groups, dc=example,dc=com

For more information on user access roles, see 

From the 

 list, select the default minimum access role for users that do not belong to any 

of the specified groups. 

Press the Ctrl key while clicking role names to select multiple roles. 

If you used static groups, in the 

 field, type the LDAP attribute that designates 

membership in a static group. 

For example, if the 

member

 attribute is used to indicate membership in the static group you reference for 

default Security Analyst access, type 

member

.

If you used dynamic groups, in the 

 field, type the LDAP attribute that contains 

the LDAP search string used to determine membership in a dynamic group. 

For example, if the 

memberURL

 attribute contains the LDAP search that retrieves members for the 

dynamic group you specified for default Admin access, type 

memberURL

.

Continue with 

Any

You can also use the LDAP server to authenticate accounts for shell access on your managed device or 
Defense Center. Specify a search filter that retrieves entries for users you want to grant shell access. Note 
that you can only configure shell access for the first authentication object in your system policy. For 
more information on managing authentication object order, see 

Cisco does not support external authentication for virtual devices or Sourcefire Software for  X-Series. 
In addition, IPv6 is not supported for shell access authentication.

With the exception of the admin account, shell access is controlled entirely though the shell access 
attribute you set. The shell access filter you set determines which set of users on the LDAP server can 
log into the shell.