topic User id integration cisco ISE in General Topics

User id integration cisco ISE

mhmameen — Sun, 05 May 2024 17:24:29 GMT

hi i did User id integration cisco ISE using syslog field identifier as article http://k12itdir.blogspot.com/2016/02/paloalto-user-id-from-cisco-ise-nodes.html?m=1 and its working fine . Problem its just send user name without domain and since i have another integration with Active Directory i got domain\username . My request how to have user from ISE to be same like Active Directory domain\username

Re: User id integration cisco ISE

kiwi — Mon, 06 May 2024 07:38:03 GMT

Hi @mhmameen ,

I haven't tested this myself but I came across this Cisco community post saying there's a known problem sending domain\username format in ISE and some users provided different regexes for username detection:

https://community.cisco.com/t5/network-security/ise-send-bad-information-for-palo-alto-user-id-agent/td-p/3350697

Hope this helps,

-Kim.

Re: User id integration cisco ISE

TomYoung — Tue, 07 May 2024 00:00:45 GMT

Hi @mhmameen ,

If you add the Default Domain Name to your User-ID Monitored Server you have configured for ISE, it should prepend all usernames with domain\.

Thanks,

Tom