Network Management

Reply
Occasional Contributor I
Posts: 6
Registered: ‎08-17-2016

Anyway to save data from data path sessions to an external server?

We want to be able to keep history of our user flow data (example: datapath session table or NAT address traslation table) from our guest network.  Does anyone know a way of doing this?

 

Scenario: we have our guest network interface setup with "ip nat inside" on the controller which NATs all guest traffic from the controller's interface. Seurity team picks up malware signatures on the edge but all they see on the source IP is the controller's interface IP.  They want to be able to match destination traffic to the internal source behind the controller's NAT.

 

Any help would be appreciated.

 

Thank you

MVP
Posts: 1,011
Registered: ‎04-13-2009

Re: Anyway to save data from data path sessions to an external server?

Airwave captures this information really well. Other than that you could setup a syslog server and send the controller logs to it, this might show you the IP to user mapping. This is probably worth investigating if Airwave isn't an option.

Cheers
James

-------------------------------------------------------
-------------------@whereisjrw-------------------
------------------------blog-------------------------
ACCX #540 | ACMX #353 | ACDX #216
-----------Mobility First Expert #11----------
-------------------------------------------------------

If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users via search.
Occasional Contributor I
Posts: 6
Registered: ‎08-17-2016

Re: Anyway to save data from data path sessions to an external server?

Thank you for the reply jrwhitehead.  Airwave is an option.  Could you please point me to how I would set this up on the controller and where in Airwave this infromation would be?

MVP
Posts: 1,011
Registered: ‎04-13-2009

Re: Anyway to save data from data path sessions to an external server?

Details of adding a controller to Airwave will be in the Airwave userguide.

 

As for where to look on Airwave there are probably many places but the AppRF (destinations) dashboard is a good place to start....

 

apprf-dest.jpg

 

apprf.jpg

 

apprf-fb.jpg

 

Cheers

James

Cheers
James

-------------------------------------------------------
-------------------@whereisjrw-------------------
------------------------blog-------------------------
ACCX #540 | ACMX #353 | ACDX #216
-----------Mobility First Expert #11----------
-------------------------------------------------------

If a reply adequately addresses your issue, please click on the "Accept as Solution" and "Give Kudos" button so this information can benefit other users via search.
Search Airheads
Showing results for 
Search instead for 
Did you mean: