Wired Intelligent Edge

last person joined: yesterday 

Bring performance and reliability to your network with the HPE Aruba Networking Core, Aggregation, and Access layer switches. Discuss the latest features and functionality of your switching devices, and find ways to improve security across your network to bring together a mobile-first solution
Back to discussions
Expand all | Collapse all

ids system is detecting the controller ip not device

This thread has been viewed 0 times

  • 1.  ids system is detecting the controller ip not device

    Posted Mar 30, 2016 03:22 PM

    Our IDS system (Alert Logic) detects p2p traffic coming from the guest network as coming from the controller - we currently have the controller handing out IP addresses for that network. Is there someway to get the Aruba to send the IP address of the device so that we can track what system is causing the issue?

     

    I'm stumped here and could really use some fresh eyes.

     

    thanks!

     

    Gerri



  • 2.  RE: ids system is detecting the controller ip not device

    EMPLOYEE
    Posted Mar 30, 2016 03:29 PM
    If you have IP NAT inside on your first vlan, your ids cannot see the actual IP address of the guest user. You must use a routable ip address for the ids to see the correct IP address..


  • 3.  RE: ids system is detecting the controller ip not device

    Posted Mar 30, 2016 03:36 PM

    Thank you Collin

     

    OK - so for my guest network it has the following VLAN configuration:

     


    interface vlan 100
    ip address 192.168.100.1 255.255.255.0
    ip nat inside

     

    ip dhcp pool guest
    default-router 192.168.100.1
    dns-server 10.0.1.121 10.0.1.125
    network 192.168.100.0 255.255.255.0
    authoritative

     

     

    Not sure what this command does:

     

    ip cp-redirect-address 192.168.100.1

     

    If I wanted to change that to pull the IP address (but keep the restricted access) from the DHCP servers on site - I'm not sure how to do that, or do I need to be handing out a different IP address in the internal DHCP scope on the controller?

     

    THanks!

     

    Gerri



  • 4.  RE: ids system is detecting the controller ip not device

    EMPLOYEE
    Posted Mar 30, 2016 05:28 PM
    Gerri,

    I would look to a security person in your organisation to design a networking solution that meets your security needs. I don't want to suggest something that might expose your organization to security risks.


  • 5.  RE: ids system is detecting the controller ip not device

    Posted Mar 30, 2016 05:36 PM

    I appreciate that Collin - unfortunately our Security people are looking to me to get it fixed. :(

     

    I was at one point able to pull the IP addresses for the Guest network from the DHCP server on the network - I'm no longer sure how I did that unfortunately .

    Do you have any recommendations on how to do that?

     

    Thanks!

     

    Gerri



  • 6.  RE: ids system is detecting the controller ip not device

    EMPLOYEE
    Posted Mar 30, 2016 05:41 PM
    You would have to have your guests on a fully routable subnet and NOT NAT your traffic out the controller. Run that by them...


  • 7.  RE: ids system is detecting the controller ip not device

    Posted Mar 30, 2016 06:09 PM

    Well that's what they want - now I have to make it happen.

     

    So I see on the VLAN that I have enabled source nat for this VLAN. I"m guessing that I would need to change the ip address range for the vlan to be something that is routable on my network (which is currently a 10.0.x.x)

     

    So (and I'm just trying to figure this out so forgive my ramblings) if I set up a vlan on my core switch that is the same as the vlan for the guest network on the aruba, then set up my dhcp scope for that address it *should* all work, and then all the traffic will be going  over the network and then hitting the IDSd properly, at least in theory, right?

     

    I would need to disable the DHCP pool on the aruba, but it should all work with the IDS since the natting won't take place at the router not before.

     

    My apologies for all the questions - I just don't have anybody to bounce some of these off of.

     

    Thank you in advance!

     

    Gerri