25-22
Cisco ASA Series Firewall CLI Configuration Guide
Chapter25 Configuring the ASA for Cisco Cloud Web Security
Configuration Examples for Cisco Cloud Web Security
hostname(config)# user-identity inactive-user-timer minutes 60
hostname(config)# user-identity action netbios-response-fail remove-user-ip
hostname(config)# user-identity user-not-found enable
hostname(config)# user-identity action mac-address-mismatch remove-user-ip
hostname(config)# user-identity ad-agent active-user-database full-download
If you are using more than one domain, then enter the following command:
hostname(config)# user-identity domain OTHERDOMAINNAME

Monitoring the Active Directory Groups

The following example shows how to configure Active Directory groups to be monitored:
hostname(config)# user-identity monitor user-group ASASCANLAB\\GROUPNAME1
hostname(config)# user-identity monitor user-group ASASCANLAB\\GROUPNAME2
hostname(config)# user-identity monitor user-group ASASCANLAB\\GROUPNAME3
Caution Remember to save your configuration once the above is completed.

Downloading the Entire Active-User Database from the Active Directory Server

The following command updates the specified import user group database by querying the Active
Directory server immediately without waiting for the expiration of poll-import-user-group-timer:
hostname(config)# user-identity update import-user

Downloading the Database from the AD Agent

The following example shows how to manually start the download of the database from the Active
Directory Agent if you think the user database is out of sync with Active Directory:
hostname(config)# user-identity update active-user-database

Showing a List of Active Users

The following example shows how to show the Active users:
hostname# show user-identity user active list detail
There are two download modes with Identify Firewall: Full download and On-demand.
•Full download—Whenever a user logs into the network, the IDFW tells the ASA the User identity
immediately (recommended on the ASA 5510 and above).
•On-demand—Whenever a user logs into the network, the ASA requests the user identity from AD
(ADHOC) (recommended on the ASA 5505 due to memory constraints).
Cloud Web Security with Identity Firewall Example
The following example shows how to configure Cloud Web Security with Identity Firewall on the ASA:
hostname# sh run
ASA Version 100.8(24)32
!
hostname QFW-201-QASS