topic Re: Timeout on syslog sourced User-ID mappings? in General Topics

Timeout on syslog sourced User-ID mappings?

jsalmans — Mon, 06 Dec 2021 18:19:07 GMT

Greetings all,

Taking another look at our user-id mappings with our server team today and we've landed on trying 90 minutes for AD. We set this on the agents installed on two of our AD servers and the firewall is showing the new logs coming in as having the correct timeout.

Next, I'm trying to figure out how to do this with our wireless. With Cisco ISE, I'm collecting the mappings via syslog profiles on the firewall but I don't see a way to limit the timeout there. The wireless controller has a max session timeout at around 240 minutes and I figured you'd probably want to set the corresponding user-ID mapping timeouts to just over that.

The User-ID Agent Config box has a timeout value that can be enabled and set but I wasn't sure if this would affect the syslog profiles and whether this would override the timeouts the AD agents are sending?

Thanks!

Re: Timeout on syslog sourced User-ID mappings?

BPry — Wed, 08 Dec 2021 01:34:34 GMT

@jsalmans,

The timeout configured on the firewall itself applies to all methods except for captive portal as far as I'm aware. I don't think there's any special consideration in regards to using the Windows user-ID agent as a source.

Re: Timeout on syslog sourced User-ID mappings?

jsalmans — Wed, 08 Dec 2021 21:31:52 GMT

@BPry

If that timeout is configured on the firewall, but also configured as a separate value on the Windows user-ID agent itself, which takes precedence?