Hi, trying to configure firepower v6.1 so that users are identified correctly in the analysis, connection events. I've got multiple realms configured which are all tied to their own AD servers, so can view all of the users in each group. However when users log on via captive portal it doesn't appear to be utilising the domain association within the connection events. The users are hot-office so can move around the country to various company offices and therefore cannot be restricted to a particular subnet correlating to a particular realm. I've got a test user associated to 3 realms but only appear to be hitting the first realm configured. Is it possible to have the FMC / Sensor configured to match users logging on into any realm, to be identified correctly in the connection events ?

Hope this is clear, thank you for any assistance.

Hi, the same username is in 3 different realms though there are 7 realms in all. I have actually received a response from Cisco TAC, it's just take several weeks to get this far and thought I'd put the query into this forum to see if any other's had similar issues.

The answer from Cisco is that the FMC v6.1 does not support more than two realms, in a single context, and even support of two realms is a workaround, with the first realm having the source subnet referenced as "0.0.0.0/0" equivalent to "any" and the second realm having the default "any" source subnet

A feature request has been submitted to Cisco to allow more than two realms with no workarounds but it's new so will be some time, if at all, before this feature is provided.

Hope this helps any one else reviewing this product.

Regards