Security

last person joined: 9 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

machine/user auth and accounting periodic update

This thread has been viewed 15 times

  • 1.  machine/user auth and accounting periodic update

    Posted Jul 03, 2018 06:19 AM

    Hey!

     

    I have turned on user or computer authentication and it works fine.  Computer names and users are logged and given access from the policy manager - good news.

     

    However the gateway stops after a minute.  After using a stopwatch I saw that it always went off after precisely one minute.

     

    It is due to: aaa accounting update periodic 1 in the HP switch programming.

     

    Changing it to 5 gives you 5 minutes of internet.  I have removed this command.

     

    Is this normal? and do I need the command for other purposes?



  • 2.  RE: machine/user auth and accounting periodic update
    Best Answer

    MVP
    Posted Jul 03, 2018 09:07 AM

    Instead of periodic, can you set accounting to start-stop instead?

     

    If your using ClearPass, RADIUS accounting is necessary for licensing (6.7) and to have proper Accounting data in ClearPass. You would also want RADIUS Interim-Accounting set to True in the server's RADIUS settings.



  • 3.  RE: machine/user auth and accounting periodic update

    MVP
    Posted Jul 03, 2018 09:09 AM

    In addition - the default should be 0 / disabled.

     

    HPE Networking: http://h22208.www2.hpe.com/eginfolib/networking/docs/switches/WB/15-18/5998-8152_wb_2920_asg/content/ch06s13.html

     

    Snippet from the link above:

    Syntax:

    [no] aaa accounting update periodic <1-525600>

    Sets the accounting update period for all accounting sessions on the switch.

    The no form disables the update function and resets the value to zero.

    Default: zero; disabled

     



  • 4.  RE: machine/user auth and accounting periodic update

    Posted Jul 03, 2018 09:20 AM

    Hi, Thanks for this

     

    I have Log Accounting Interim-Update Packets set to TRUE

    I had disabled/set to 0 the aaa accounting periodic update previously

     

    I have added:

     

    aaa accounting exec start-stop radius

    aaa accounting network start-stop radius

     

    to the switch programming - does it need both these commands for clearpass - assuming they are correct?

     

    Thank you for your help

     



  • 5.  RE: machine/user auth and accounting periodic update

    MVP
    Posted Jul 03, 2018 09:22 AM

    Exec would be for administration of the switch - console, ssh, telnet.

     

    Network would be for device authentications on the ports.



  • 6.  RE: machine/user auth and accounting periodic update

    Posted Jul 03, 2018 09:26 AM

    great, thanks for clearing that up I will go with 

     

    aaa accounting network start-stop radius

     

    then 



  • 7.  RE: machine/user auth and accounting periodic update

    EMPLOYEE
    Posted Jul 03, 2018 11:00 AM

    Be sure to follow the ClearPass Solution Guide for Wired Policy Enforcement for fully validated configurations.