Higher Education

Reply
This is an open group. Sign in and click the "Join Group" button to become a group member and start posting.
Highlighted
Contributor II

ClearPass Report

How do you setup an alert in Insight that provide you with the following:

 

Alert you if there is more than 100 Failed Authentication within 5 minutes. The goal is the create an alert that you let you know that there might be a radius or authentication or ad issues becuase large amount of users are unable to authenticate agaist clearpass. 

 

When you use the default template in Insight: Radius Failed Authentication You can select Threshold  and Interval. However, this alert only give you the amount of failed auth Accumulated in a internal so you might get 10 or 25 failed authentication but this does not mean necessariliy that there is a problem.

 

Should i use airwave instead?

 

Thank you

Nils

15 REPLIES
Guru Elite

Re: ClearPass Report

Do you use Splunk? 


Thanks, 
Tim

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Contributor II

Re: ClearPass Report

I've been using Airwave and it works great.

'Client RADIUS Authentication Issues' for Type

Duration 5 minutes

Count >= 100

 

I have it send an e-mail.

 

Contributor II

Re: ClearPass Report

I am currently using the free version and works great! Company hasnt bought the full subscription yet so i was wondering i can get an alert using clearpass in the meantime.

 

Thank you

Guru Elite

Re: ClearPass Report

You can use AirWave for now. Once you get full Splunk, there is a full ClearPass app for it. 


Thanks, 
Tim

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Contributor II

Re: ClearPass Report

That would be a good argument for me to convience top mgnt to release the budget. Thank you. Is there is a guide that talk about the integration of Splunk with ClearPass?

Guru Elite

Re: ClearPass Report

There is a technote on the support site. 


Thanks, 
Tim

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480

Re: ClearPass Report

If you have access to solution exchange.

https://ase.arubanetworks.com/solutions/id/70
Pasquale Monardo | Senior Network Solutions Consultant
ACDX #420 | ACMP
[If you found my post helpful, please give kudos!]
Aruba

Re: ClearPass Report

You can easily setup the alert in insight. I will try to post a screen shot when my flight lands or if we ask really nice Tim or Victor can log into my lab and grab a screen shot of my tacacs alert. :)
Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Guru Elite

Re: ClearPass Report

See the attached screenshot that Troy was talking about. Just change it to RADIUS instead of TACACS

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: