Security

Reply
Occasional Contributor I
Posts: 8
Registered: ‎09-15-2016

Search for Client IP Address in ClearPass

Hello,

 

I was wondering if anyone knew how to search for a client IP address in ClearPass? For instance, I want to see which client was assigned a specific IP address at a specific time. If I look in Access Tracker and click on a session I can see the "Radius:IETF:Framed-IP-Address" attribute in the RADIUS response but I cannot see a sensible way of searching for this.

 

Any help would be appreciated.

 

Thanks.

Guru Elite
Posts: 8,759
Registered: ‎09-08-2010

Re: Search for Client IP Address in ClearPass

You would use Insight to run a report.

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Occasional Contributor I
Posts: 8
Registered: ‎09-15-2016

Re: Search for Client IP Address in ClearPass

Thanks for this but when I run a report on a framed IP nowhere does it say what device was given this IP at what time etc.

Frequent Contributor II
Posts: 184
Registered: ‎04-17-2013

Re: Search for Client IP Address in ClearPass

[ Edited ]

You have to enable radius accounting in instance. And then check in CPPM access tracker session last tab

 

Occasional Contributor I
Posts: 8
Registered: ‎09-15-2016

Re: Search for Client IP Address in ClearPass

Yes I know I can find the Framed IP that way, but how do I search for it without sifting through thousands of entries in access tracker? Presuming I know nothing about the username, SSID etc. All I have is the IP address and want to find what user was allocated that address at a specific time?

Occasional Contributor I
Posts: 8
Registered: ‎09-15-2016

Re: Search for Client IP Address in ClearPass

[ Edited ]

To give you the exact scenario may help....

 

We are informed by our ISP that a copyright infringment has taken place on our network. All they can tell us about the culprit is the IP address and the time the offence took place.

 

Is there a way to find out in Insight/CPPM who was assigned that IP    address at the specific time?

 

Obviously CPPM has the data as I can see the IP address by looking at the Radius response but how do I search for that?

Aruba
Posts: 1,548
Registered: ‎06-12-2012

Re: Search for Client IP Address in ClearPass

Like Tim stated you can do IP search in insight. This was all taken from a 6.6.5 version of CPPM. One thing I would suggest is to also file a RFE for this to be avilible in the search bar on top. You can get the total number of auths in the quick view but not the auth times. 

 

Screen Shot 2017-06-07 at 4.01.01 AM.png

 

Screen Shot 2017-06-07 at 4.01.20 AM.png

 

To get the full auth record you will need to include CSV.

 

 

Screen Shot 2017-06-07 at 4.02.25 AM.png

 

Screen Shot 2017-06-07 at 4.02.32 AM.png

 

Here is a sameple

Screen Shot 2017-06-07 at 4.04.11 AM.png

Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Occasional Contributor I
Posts: 8
Registered: ‎09-15-2016

Re: Search for Client IP Address in ClearPass

Thanks Tarnold. Very helpful. Will certainly submit an RFE.

Search Airheads
Showing results for 
Search instead for 
Did you mean: