CDA - Mappings

[lm20ele]

Hello,

Does anyone knows how long are the IP-to-user mappings kept on the Cisco Context Directory Agent?

Is there a setting that dictates for how long to keep these mappings if a user doesn't logoff?

The scenario i have seen is that user lock their PCs but do not logoff and after a while the mapping dissapears.

Thanks

[Slava Monakhov]

Hello,

I have the same problem, as I see noone knows the issue.

[Marius Gunnerud]

There is a user inactivity setting which is set to a default of 60 minutes.

You can configure the timeout by using the following command:

user-identity inactive-user-timer minutes 120

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/aaa_idfw.html#pgfId-1322556

The link should open to the Configuring Identity Options portion of the document, but you need to scroll a little down to find the command and the description.

--

Please remember to select a correct answer and rate helpful posts

[Marius Gunnerud]

Thank you for the rating.

Could you please mark the answer as correct also.

[Slava Monakhov]

Marius,

Thank You for answer. This is helpfull for ASA transparent authentication. I have the problem with Cisco WSA installation. When User login domain I see "Added Mapping Record From Active Directory" event on Cisco CDA's Live logs. When I logoff domain I see "Updated Mapping Record From Active Directory" on Cisco CDA's Live logs and I have still a record in ip-username mapping table. Do You know issue of this problem?

[Marius Gunnerud]

I am uncertain on this.  It could very well be a bug and that the CDA still looks to the logon epiration timer to mark the user as logged out.  Or perhaps this is there by design?

If you need to find the answer to this, I suggest opening a case with Cisco TAC.

--

Please remember to select a correct answer and rate helpful posts