Create an identity mapping filter

Create an identity mapping filter to limit the networks to which an identity rule applies and optimize device memory usage for managed devices.

An identity mapping filter can be used to limit the networks to which an identity rule applies. For example, if your Firewall Management Center manages FTDs that have a limited amount of memory, you can limit the networks they monitor.

You must create separate identity mapping filters for IPv4 and IPv6 addresses.

You can also optionally exclude subnets from the following:

Receiving user-to-IP and Security Group Tag (SGT)-to-IP mappings from ISE.
Receiving user-to-IP mappings from the passive identity agent.

You should typically do this for lower-memory managed devices to prevent Snort identity health monitor memory errors.

Follow these steps to create an identity mapping filter.

Before you begin

Perform the following tasks:

Create any of the following:
- LDAP or Microsoft Active Directory realm. See Create an LDAP realm or an Active Directory realm and realm directory.
- ISE/ISE-PIC identity source. See Ways to configure the Cisco Identity Services Engine (Cisco ISE) identity source.
- Captive portal identity source. See Configure the captive portal for user control.
- Passive Identity Agent identity source. See How to configure a passive identity agent identity source.
- TS Agent identity source. See Terminal services agent identity source.
- RA-VPN identity source. See Configure Remote Access VPN for AD-authenticated users.
Create a network object or network group object as discussed in Networks. The network object or group you create should define the network you want managed devices to monitor in identity policies.

Procedure

Step 1

Start creating an identity policy.

Step 2

From the Identity Mapping Filter list, do any of the following:

Click a network object from the list.
Click Add () and follow the prompts on your screen to create either a network object or a network group object. For more information, see Networks.

What to do next

Continue configuring your identity policy.