Security

Does Clearpass integrate with Palo Alto Firewalls at all? 

Yes

 

http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=14554

 

http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=13372

 

cool.. is it only if we are using Clearpass as our MDM solution?

No. Basic RADIUS is integrated as well.

Also, there is direct Palo integration on controllers running 6.3 and higher.

I am running 6.4.1.0 -- where is the Palo section?

.PALO Config

To configure the server info:

Configuration > All profiles


Then you need to enabled the "PAN integration" check box in your AAA profile(s)

So…..we can setup policy on Palo for guests and be able to identify guest accounts? For example, if guest “test123” is streaming Netflix all day, Palo will identify the guest user as “test123”?

Does the link here:  Pano Feature Explained answer your question?

 

sorta.. I dont know if we will get detailed information with Guest users though.

RR8,

 

The controller simply passes on the username and password to PAN.  Pan needs to do something with that username and password, like authenticate it to a database and assign it to a specific profile.  What can be monitored after the user info is passed onto PAN is a PAN question....

RR*,

 

Tim has pointed you to two TechNotes aof mine which spell out how to configure CPPM + PANW. One of the doc clearly discusses some more advanced deployments utilizing PAN HIP Objects.

 

To answer your speciic question, YES, we will send the guest userid (P.S. we never send the password) to the PANW and the PANW can then enforce a policy based upon the userid or lots of other attributes we send, that can be used to limit this user from download/streaming content.

 

 

cool thanks!  I will give it a try

Is there another tech note or write up for the configurations necessary on the PANW side?  I got the Clearpass side all setup.. Looks like the tech note attached in this thread has some incorrect information... There is no Dynamic option when adding a new address??

 

 

RR8,

 

Looks like you have an OLD TechNote their of mine. Please take a look at the V4 TechNote covering CPPM+PANW on the support site.

 

 

very confusing.. so I have to create tags and apply to a hip profile to get this working?