Security

last person joined: 22 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Event Login Reject

This thread has been viewed 0 times

  • 1.  Event Login Reject

    EMPLOYEE
    Posted Oct 29, 2017 02:51 PM
      |   view attached

    Hi,

     

    I'm getting an unknown event on the ClearPass access tracker, which shows Event login reject without any more information?!

    This log keeps repeating and i don't know how to get rid of it....

     

    01.jpg

    i alos attached the export log.

    Attachment(s)

    txt
    Dashboard_Details.txt   594 B 1 version


  • 2.  RE: Event Login Reject
    Best Answer

    EMPLOYEE
    Posted Oct 30, 2017 03:39 AM

    I have seen this in the past, and have an idication that it is from the Ingress Event Engine and related with a port-scan on your ClearPass appliance on the syslog port; which could be originating even from your ClearPass if you enabled the subnet scans. I have not further investigated yet myself.

     

    If you don't use Ingress Event Engine, turn it off [in server manager]

    Try to find where the scans on the syslog port may be originating from and try to disable it there; if it is your ClearPass subnet scan, disable it for the network where your ClearPass lives.

    Open a case with your partner or Aruba Support (TAC) if you can't find the source.



  • 3.  RE: Event Login Reject

    EMPLOYEE
    Posted Oct 31, 2017 03:57 PM

    Hi Herman,

     

    Thank you for your quick replay and great support,

    this was indeed the problem and i fixed it.

     

    Cheers,

    Tal