Endpoint Identification identifies which IPv4 address belongs to which user. This
allows a method of user identification to be built using an IPv4 address-to-user mapping
cache
for policy matching.
By default, Endpoint Identification cannot automatically identify IPv4 addresses.
You must specify which IP addresses or IP address ranges to use when using Endpoint
Identification. If a source IPv4 address is not in the defined ranges within the defined
address
objects, the IPv4 address will not work for Endpoint Identification.
If Cloud Edge cannot associate the user with an
IPv4 address, Captive Portal can take over and authenticate the user with a web form
(if
enabled).
 |
NoteEndpoint Identification mapping requires that the firewall obtain the source IPv4
address of the user before the IPv4 address is translated with NAT. If multiple users
appear to
have the same source address, due to NAT or use of a proxy device, accurate user identification
is not possible.
|
|
NoteIPv6 addresses cannot be used for Endpoint Identification. For IPv6 traffic, the
Captive Portal page does not open and IPv6 traffic will pass. Keep the following in
mind when
configuring Endpoint Identification profiles:
|