Security

Reply
Frequent Contributor I
Posts: 97
Registered: ‎04-13-2009

PaloAlto and CPPM 6.3.1 integration

[ Edited ]

Hi all, 

I am trying to integrate Palo and CPPM. Unfortunately CPPM does not send any info to Palo. I see log-in/out at Palo however in the log from CPPM there is no <uid-message> and there are entries as follows: 

[TIME Stamp] WARNING root pactrlmonitprofile Not sending userid object for padevice=[one  of my Palo's interfaces] as the data or auth_token is empty

 

It seems that CPPM is misconfigured. Any ideas? 

Many regards, 

 

Marek Krauze, CWNE# 174, ACMX #295, ACDX #356
Something cool, helpful or interesting in my post - click the Kudos Star.
Helped to solve your problem - Click Accept as Solution
Moderator
Posts: 470
Registered: ‎11-09-2012

Re: PaloAlto and CPPM 6.3.1 integration

Do you follow my TechNote describing the CPPM/PANW integration?


Best Regards
-d

Snr Tech Marketing Engineer - ClearPass

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Frequent Contributor I
Posts: 97
Registered: ‎04-13-2009

Re: PaloAlto and CPPM 6.3.1 integration

Absolutely, l did. Additionaly uou did not mention about enabling Userid per zone that is a key. The issue is at CPPM side I guess. 

Many regards, 

 

Marek Krauze, CWNE# 174, ACMX #295, ACDX #356
Something cool, helpful or interesting in my post - click the Kudos Star.
Helped to solve your problem - Click Accept as Solution
Moderator
Posts: 470
Registered: ‎11-09-2012

Re: PaloAlto and CPPM 6.3.1 integration

OK  - Great, I know you have the basic covered.

 

What version of PANW?

What version of CPPM?

 

You don't have multi-vsys do you?

Nn 'funny' permit/deny rules in PANW stopping CPPM post the data to the PANW node?

 

 

After a user associates to an ssid and you get the auth in CPPM, do you see in the access tracer for the user session an 'Accounting' Tab for the session?

 


Best Regards
-d

Snr Tech Marketing Engineer - ClearPass

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Frequent Contributor I
Posts: 97
Registered: ‎04-13-2009

Re: PaloAlto and CPPM 6.3.1 integration

Now I checked twice and found lack of Accounting at the controller. Now it looks fine! Thanks for tip.

BTW, it was CPPM 6.3.1, PA-VM-6.0.0 and IAP 4.0.0.4 

 

Many regards,

 

 

 

Marek Krauze, CWNE# 174, ACMX #295, ACDX #356
Something cool, helpful or interesting in my post - click the Kudos Star.
Helped to solve your problem - Click Accept as Solution
Moderator
Posts: 470
Registered: ‎11-09-2012

Re: PaloAlto and CPPM 6.3.1 integration

Great to hear..... Pretty sure I have checking the accounting on the Ctrls

Best Regards
-d

Snr Tech Marketing Engineer - ClearPass

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Moderator
Posts: 470
Registered: ‎11-09-2012

Re: PaloAlto and CPPM 6.3.1 integration

Just wanted to ask.....

 

Can you please expand on this "Additionaly uou did not mention about enabling Userid per zone that is a key"....??

 

 

So I can add to my next CPPPM/PANW TechNote update.

 

Cheers.


Best Regards
-d

Snr Tech Marketing Engineer - ClearPass

-- Found something helpful, important, or cool? Click the Kudos Star in a post.
-- Problem Solved? Click "Accept as Solution" in a post.
Search Airheads
Showing results for 
Search instead for 
Did you mean: